Omniauth OAuth2 confusion (CVE-2012-6134)

[thesp0nge]

Omniauth OAuth2 confusion (CVE-2012-6134)

[thesp0nge]

Well the CVE-2012-6134 security check [1] does check for Omni Authversion > 1.1.2. If your project uses gem version 1.1.1 dawn should raise an issue here.

Have you got an application to test against?
[1] https://github.com/codesake/codesake_dawn/blob/master/lib/codesake/dawn/kb/cve_2012_6134.rb

Yes, that game is being flagged in my application. The problem is that the latest available gem is still v1.1.1 - there is no v1.1.2. That is why I am trying to determine if 1.1.1 was indeed the fixed version (and therefore your check should look for it), or the vulnerability still exists...?

[razielgn]

Hitting the same issue. Has the situation changed?

[thesp0nge]

@marinerJB have you got some news? Did the published PoC work with your application with 1.1.1 gem?

If it doesn't work, I'll change the security check

[thesp0nge]

Gents, the situation is not changed.
As you may read here (https://gemnasium.com/gems/omniauth-oauth2) version 1.1.1 that is the latest available suffers from CSRF vulnerability as Codesake::Dawn reports. Vendor has not yet release any fix.
Il will change the mitigation message for this check and closing this issue