Re: CVE request: rubygem omniauth-facebook CSRF vurnerability

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/12/2013 01:58 PM, Josef Šimánek wrote:
> # RubyGem omniauth-facebook CSRF vulnerability
>
> There is a security vulnerability in the CSRF protection of 
> omniauth-facebook 1.4.1.
>
> Versions affected: 1.4.1 Not affected:      <= 1.4.0 (*) Fixed
> versions:    >= 1.5.0
>
> (*) Versions <= 1.4.0 did not have any CSRF protection. So, while
> this vulnerability does not directly affect versions <= 1.4.0,
> downgrading to <= 1.4.0 is not a fix.
>
> ## Impact
>
> Because of the way that omniauth-facebook supports setting a 
> per-request state parameter by storing it in the session, it is 
> possible to circumvent the automatic CSRF protection. Therefore
> the CSRF added in 1.4.1 should be considered broken.
>
> If you are currently providing a custom state, you will need to
> store and retrieve this yourself (for example, by using the session
> store) to use 1.5.0.
>
> All users running an affected release should upgrade to 1.5.0.
>
> ## Releases
>
> The 1.5.0 releases is available at the normal locations.
>
>
> ## Workarounds
>
> None.
>
> ## Credits
>
> Egor Homakov (@homakov)
>
>
> regardsJosef Šimánek

Can you link to the vulnerable code  or the code commit fixing this?
thanks.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSgpkSAAoJEBYNRVNeJnmTiJkP/jON6q5ZPsPNV+5Ib8yMIK+K
cGGvskIE/2+LOS9ThwvqjMiAG/w+97Q9bqr0cHiSH0Tcehg6GWlCkggW3Jq72ZP1
P6ECUU62VuemtaYfsCjPLunQP9S0zZpS2bdOYFyl22pUSKncwPy4fiZZ8cpyGkfe
0qCJxf36mOJjQTRzJe+IAFCBzLshkHroK//fnT326Mv172hEr/z40JoQKw/df0+b
DL4XDjbkxLcCXJH8pNelU/qbBwpLBlHgT9/noFX7Ic9oIkoZDKDTBhJ8QhXHAarO
5DJWgRdEw9tvdf3XsRjbVFsT2UKcCufvnKXUmwbFslTpVWrLRUYnI18Q4Sh3xzGw
gme/u0fecRQKW1nR8j+m1BS8a9rzAX267RmQJCqQsoQTOGf0c53dTZuBBTup/b3W
1aMjxbovvhXSomQID/GNvTTL8BeiJk6nOhddHYRe+zyLWI7+mOqkQKZRRGn/xTH6
LFjdsPNYoRfCwqt8GEuHpUeBTGe+tztNxa6AePXbtN6ucW4ADBdPHswXE5b7JWsI
amCOAh5+EUpN1YVcolW2KESEW8lW8XC6zHJIqF53oBUf77gzmIcLyfq5KQG/fFxM
Jque0YAq2xfkx0hQBg/m6f6oi/5AGKdgTLTRi3NvRx079N+/veS4JnLzcX8lwSKB
AzvOWhoza+2y7iPRyULE
=ZZJQ
-----END PGP SIGNATURE-----