PT-2019-12147 · Ruby · Ruby-Openid

Chris · Published 2019-06-10 · Updated 2019-10-11 · CVE-2019-11027

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruby OpenID (aka ruby-openid) versions 2.8.0 and earlier

Description The issue allows for a remotely exploitable flaw, specifically a Server-Side Request Forgery (SSRF) vulnerability. This occurs because the library performs discovery first, and then verification, enabling an attacker to change the URL used for discovery and trick the server into connecting to a potentially private server not publicly accessible. The severity of this issue can range from medium to critical, depending on how the ruby-openid library is employed by web application developers. Developers who based their OpenID integration heavily on the example app provided by the project are at the highest risk.

Recommendations For versions 2.8.0 and earlier, consider disabling the OpenID discovery feature until a patch is available, or restrict the URLs that can be used for discovery to prevent SSRF attacks.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2019-11027

DLA-1956-1

GHSA-FQFJ-CMH6-HJ49

Affected Products

Ruby-Openid

References · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml · Exploit
• https://ubuntu.com/security/CVE-2019-11027 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fqfj-cmh6-hj49 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1956-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11027 · Security Note
• https://security.gentoo.org/glsa/202003-09 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11027 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11027 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11027 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11027 · Security Note
• https://github.com/openid/ruby-openid · Note
• https://github.com/openid/ruby-openid/releases/tag/v2.9.0 · Note
• https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131 · Note
• https://github.com/openid/ruby-openid/issues/122 · Note