PT-2022-9003 · Omniauth+1 · Omniauth+1

Published 2022-08-18 · Updated 2024-06-18 · CVE-2020-36599

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OmniAuth versions prior to 1.9.2 OmniAuth versions prior to 2.0

Description The issue is related to the lib/omniauth/failure endpoint.rb file in OmniAuth, where the message key value is not properly escaped. This could potentially lead to security issues.

Recommendations For OmniAuth versions prior to 1.9.2, update to version 1.9.2 or later. For OmniAuth versions prior to 2.0, update to version 2.0 or later. As a temporary workaround, consider restricting access to the failure endpoint until a patch is available.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2020-36599

GHSA-PM55-QFXR-H247

Affected Products

Debian

Omniauth

References · 15

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2020-36599.yml · Exploit
• https://github.com/omniauth/omniauth/commit/43a396f181ef7d0ed2ec8291c939c95e3ed3ff00#diff-575abda9deb9b1a77bf534e898a923029b9a61e991d626db88dc6e8b34260aa2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-36599 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pm55-qfxr-h247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36599 · Security Note
• https://ubuntu.com/security/CVE-2020-36599 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36599 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36599 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36599 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36599 · Vendor Advisory
• https://github.com/omniauth/omniauth · Note
• https://t.me/cvenotify/34970 · Telegram Post
• https://rubygems.org/gems/omniauth/versions/1.9.2 · Note
• https://t.me/cvenotify/83640 · Telegram Post
• https://t.me/cibsecurity/48422 · Telegram Post