Advertisement




Edit Report

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2013110114

Below is a copy:

# RubyGem omniauth-facebook access token security vulnerability

There is a security vulnerability in the omniauth-facebook <= 1.5.0.

    Versions affected: <= 1.5.0
    Fixed versions:    >= 1.5.1

## Impact

Because omniauth-facebook <= 1.5.0 supports passing an access token
directly in the URL, an attacker may be able to authenticate as
another user by passing a valid access token obtained from Facebook
for another app.

If you're currently using this feature, and passing the access token
directly, you should change your integration to use one of the secure
methods using either a signed request or the code flow. These secure
methods are default, so unless you are explicitly passing an access
token you should not need to make any integration changes to upgrade
to 1.5.1.

All users running an affected release should upgrade to >= 1.5.1.

## Releases

The 1.5.1 releases is available at the normal locations.

## Workarounds

None.

## Credits

Egor Homakov (@homakov)

Copyright ©2022 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.