OmniAuth Host Header Injection Vulnerability

Executive Summary

OmniAuth before version 2.2.0 allows host header injection by deriving callback URLs from request-controlled host information when no fixed full_host or framework-level host validation is configured. Attackers can forge Host headers to manipulate callback URLs, potentially redirecting users to malicious sites.

Useful 0 Not Useful 0

Detection Guidance

Check if your OmniAuth version is below 2.2.0 by running gem list omniauth in your Ruby environment. If vulnerable, inspect HTTP headers like Host, X-Forwarded-Host, or Forwarded in application logs for unexpected values. Enable OmniAuth debug logging to monitor callback URL generation and host validation failures.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to redirect users to phishing sites, steal session tokens, or perform other malicious actions. Applications using Rails with host validation or a fixed full_host are not affected.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OmniAuth to version 2.2.0 or later. Configure the allowed_hosts option with trusted host strings or regex patterns. For Rails apps, ensure framework-level host header validation is enabled. If neither is possible, implement network-level host header validation as a temporary measure.

Useful 0 Not Useful 0