CVE-2015-9284

Vulnerability

Overview The OmniAuth Ruby gem [1] (versions 1.9.1 and earlier) contains a Cross-Site Request Forgery (CSRF) vulnerability in its request phase when used with Ruby on Rails [2]. The root cause is that the request phase does not validate any CSRF token, allowing an attacker to initiate an OAuth authentication flow on behalf of a victim without their knowledge or consent [4].

Exploitation

Details To exploit this, an attacker must trick a victim who is already authenticated to the target web application into visiting a crafted URL or page that triggers a request to the OmniAuth request phase (e.g., /auth/provider). If the victim has previously authorized the OAuth provider (e.g., Google) to access their account on the target application, the attacker can link their own OAuth account to the victim's account without any user interaction [4]. The attack is particularly effective when combined with a CSRF vulnerability on the OAuth provider side, but the OmniAuth CSRF alone is sufficient if the provider does not require re-authorization [4].

Impact

Successful exploitation allows the attacker to subsequently sign in to the web application using their own OAuth account, which is now linked to the victim's primary account [2]. This grants the attacker full access to the victim's account and any associated data or privileges.

Mitigation

The vulnerability is addressed in OmniAuth version 2.0.0, which defaults to only accepting POST requests for the request phase and introduces a configurable request_validation_phase for CSRF protection [3]. Users of earlier versions should upgrade to 2.0.0 or implement application-level CSRF protection as recommended in the OmniAuth documentation [3][4].