Open Redirect Affecting clearance Open this link in a new tab package, versions <2.5.0
Attack Complexity
Low
User Interaction
Required
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-RUBY-CLEARANCE-1577284
-
published
31 Aug 2021
-
disclosed
31 Aug 2021
-
credit
Snyk Security Team
Introduced: 31 Aug 2021
CVE-2021-23435 Open this link in a new tabHow to fix?
Upgrade clearance
to version 2.5.0 or higher.
Overview
clearance is an authentication app for rails.
Affected versions of this package are vulnerable to Open Redirect. The vulnerability can be possible when users are able to set the value of session[:return_to]
. If the value used for return_to
contains multiple leading slashes (/////example.com
) the user ends up being redirected to the external domain that comes after the slashes (http://example.com
).