PT-2020-16380 · Omniauth · Omniauth-Apple

Davidtaylorhq · Published 2020-12-08 · Updated 2020-12-10 · CVE-2020-26254

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions omniauth-apple versions prior to 1.0.1

Description The issue allows attackers to fake their email address during authentication, impacting applications that use the omniauth-apple strategy of OmniAuth and the info.email field for identification. The value of info.email can be set to any value, including other users' email addresses. Applications not using info.email for identification but using the uid field are not impacted in the same manner, although they may still be negatively affected if info.email is used for other purposes.

Recommendations To resolve the issue, upgrade to omniauth-apple version 1.0.1 or later. As a temporary workaround, consider monkey patching OmniAuth::Strategies::Apple#email to use id info['email'] instead.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2020-26254

GHSA-49R3-2549-3633

Affected Products

Omniauth-Apple

References · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-apple/CVE-2020-26254.yml · Exploit
• 🔥 https://github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633 · Exploit
• https://github.com/nhosoya/omniauth-apple/commit/b37d5409213adae2ca06a67fec14c8d3d07d9016 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26254 · Security Note
• https://osv.dev/vulnerability/GHSA-49r3-2549-3633 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26254 · Vendor Advisory
• https://github.com/nhosoya/omniauth-apple/blob/master/CHANGELOG.md#101---2020-12-03 · Note
• https://github.com/nhosoya/omniauth-apple · Note
• https://t.me/cvenotify/6735 · Telegram Post
• https://t.me/cibsecurity/17252 · Telegram Post
• https://t.me/cvenotify/6958 · Telegram Post