CVE-2015-9284: Cross-Site Request Forgery (CSRF)

April 26, 2019 (updated November 13, 2020)

The request phase of the OmniAuth is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

References

github.com/omniauth/omniauth-rails/pull/1
github.com/omniauth/omniauth/pull/809
github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
nvd.nist.gov/vuln/detail/CVE-2015-9284
www.openwall.com/lists/oss-security/2015/05/26/11

Code Behaviors & Features

Detect and mitigate CVE-2015-9284 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →