PT-2019-14810 · Plataformatec · Devise Token Auth

Alboxie · Published 2019-09-24 · Updated 2022-05-24 · CVE-2019-16751

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Devise Token Auth versions through 1.1.2

Description An issue was discovered in the omniauth failure endpoint, which is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the fallback render method in the omniauth callbacks controller.

Recommendations For Devise Token Auth versions through 1.1.2, consider disabling the fallback render method in the omniauth callbacks controller as a temporary workaround until a patch is available. Restrict access to the omniauth failure endpoint to minimize the risk of exploitation. Avoid using the message parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16751

GHSA-MVQR-R76C-WM5F

Affected Products

Devise Token Auth

References · 6

• 🔥 https://github.com/lynndylanhurley/devise_token_auth/issues/1332 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise_token_auth/CVE-2019-16751.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16751 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16751 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvqr-r76c-wm5f · Vendor Advisory
• https://github.com/lynndylanhurley/devise_token_auth · Note