oss-security - CVE request: rubygem omniauth-facebook CSRF vurnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFp7Qwpok0LY-Uimckrz5B+BiDqd14rXFAAYFFsJDHnifpx-3A@mail.gmail.com>
Date: Tue, 12 Nov 2013 21:58:35 +0100
From: Josef Šimánek <josef.simanek@...il.com>
To: oss-security@...ts.openwall.com
Cc: Mark Dodwell <mark@...ynamic.co.uk>
Subject: CVE request: rubygem omniauth-facebook CSRF vurnerability

# RubyGem omniauth-facebook CSRF vulnerability

There is a security vulnerability in the CSRF protection of
omniauth-facebook 1.4.1.

    Versions affected: 1.4.1
    Not affected:      <= 1.4.0 (*)
    Fixed versions:    >= 1.5.0

(*) Versions <= 1.4.0 did not have any CSRF protection. So, while this
vulnerability does not directly affect versions <= 1.4.0, downgrading
to <= 1.4.0 is not a fix.

## Impact

Because of the way that omniauth-facebook supports setting a
per-request state parameter by storing it in the session, it is
possible to circumvent the automatic CSRF protection. Therefore the
CSRF added in 1.4.1 should be considered broken.

If you are currently providing a custom state, you will need to store
and retrieve this yourself (for example, by using the session store)
to use 1.5.0.

All users running an affected release should upgrade to 1.5.0.

## Releases

The 1.5.0 releases is available at the normal locations.

## Workarounds

None.

## Credits

Egor Homakov (@homakov)

regardsJosef Šimánek

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.