5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
48.5%
This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email
field of OmniAuth’s Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker’s choice including email addresses of other users.
For example, an application using omniauth-apple with the following code will be impacted:
def omniauth_callback
auth_hash = request.env['omniauth.auth']
@authenticated_user = User.find_by(email: auth_hash.info.email)
end
Applications not using info.email
for identification but are instead using the uid
field are not impacted in the same manner. Note, these applications may still be negatively affected if the value of info.email
is being used for other purposes.
Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.
If unable to upgrade to a patched version, monkey patching OmniAuth::Strategies::Apple#email
as follows is advised as a workaround:
module OmniAuth
module Strategies
class Apple
def email
id_info['email']
end
end
end
end
CPE | Name | Operator | Version |
---|---|---|---|
omniauth-apple | lt | 1.0.1 |
github.com/advisories/GHSA-49r3-2549-3633
github.com/nhosoya/omniauth-apple/blob/master/CHANGELOG.md#101---2020-12-03
github.com/nhosoya/omniauth-apple/commit/b37d5409213adae2ca06a67fec14c8d3d07d9016
github.com/nhosoya/omniauth-apple/security/advisories/GHSA-49r3-2549-3633
github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-apple/CVE-2020-26254.yml
nvd.nist.gov/vuln/detail/CVE-2020-26254
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
48.5%