search

reu / omniauth-steam

Steam authentication strategy for OmniAuth
93 stars 38 forks source link

Fix 2 vulnerabilities in callback handling #36

Open Arie opened 1 month ago

Arie commented 1 month ago

Fix two vulnerabilities based on the work of the passport-steam node.js library.

  1. Check for the correct ns, identity and claimed_id. See https://github.com/liamcurry/passport-steam/pull/120#issuecomment-1596185704 for how this was abused.
  2. Check there aren't any extra query parameters in the callback URL. This was used to inject extra parameters containing unicode null bytes, allowing logging in with a steam id of the attacker's choosing. Based on https://github.com/liamcurry/passport-steam/pull/127