RubyGem omniauth-facebook CSRF vulnerability

2013.11.13

Credit: Egor Homakov

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2013-4562

CWE: CWE-352

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

# RubyGem omniauth-facebook CSRF vulnerability

There is a security vulnerability in the CSRF protection of
omniauth-facebook 1.4.1.

    Versions affected: 1.4.1
    Not affected:      <= 1.4.0 (*)
    Fixed versions:    >= 1.5.0

(*) Versions <= 1.4.0 did not have any CSRF protection. So, while this
vulnerability does not directly affect versions <= 1.4.0, downgrading
to <= 1.4.0 is not a fix.

## Impact

Because of the way that omniauth-facebook supports setting a
per-request state parameter by storing it in the session, it is
possible to circumvent the automatic CSRF protection. Therefore the
CSRF added in 1.4.1 should be considered broken.

If you are currently providing a custom state, you will need to store
and retrieve this yourself (for example, by using the session store)
to use 1.5.0.

All users running an affected release should upgrade to 1.5.0.

## Releases

The 1.5.0 releases is available at the normal locations.


## Workarounds

None.

## Credits

Egor Homakov (@homakov)


regardsJosef Simanek

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

RubyGem omniauth-facebook CSRF vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.