Cross-origin OAuth token-request redirects can expose signed request metadata

Summary

Affected

• oauth v1.1.5 and prior versions back to and including v0.5.5.
• The cross-host token redirect behavior was introduced by https://github.com/ruby-oauth/oauth/commit/d74b767f
• The behavior is documented in the v0.5.5 changelog as "Allow redirect to different host but same path".
• The vulnerable behavior is in OAuth::Consumer#token request, which is used by the documented request-token and access-token flows.
• The issue is not specific to a Ruby engine or platform. It is caused by the gem's redirect handling and recursive token request behavior.

Impact

1. Cross-origin signed-request metadata disclosure. The redirected request is signed for the attacker-controlled endpoint. Depending on the request method, scheme, and parameters, the attacker may receive OAuth 1.0 parameters such as oauth consumer key, oauth signature method, oauth timestamp, oauth nonce, oauth version, and oauth signature.
2. SSRF from the application server. The OAuth client follows the redirect on behalf of the application, so the redirected host is contacted from the application server's network position.
3. Confused-deputy behavior. A malicious or compromised token endpoint can cause an otherwise trusted application to initiate signed requests to an unintended origin.

Vulnerable code

def token request(http method, path, token = nil, request options = {}, *arguments)
 request options[:token request] ||= true
 response = request(http method, path, token, request options, *arguments)
 case response.code.to i

 when (200..299)
  # parse token response
 when (300..399)
  # Parse redirect to follow
  uri = URI.parse(response["location"])
  our uri = URI.parse(site)

  # Guard against infinite redirects
  response.error! if uri.path == path && our uri.host == uri.host

  if uri.path == path && our uri.host != uri.host
   options[:site] = "#{uri.scheme}://#{uri.host}"
   @http = create http
  end

  token request(http method, uri.path, token, request options, arguments)
 when (400..499)
  raise OAuth::Unauthorized, response
 else
  response.error!
 end
end

• response["location"] is trusted as the next token request target.
• Redirects are followed for every 300..399 response.
• There is no general redirect counter or maximum redirect limit.
• Cross-host redirects with the same path can mutate options[:site] and rebuild the underlying HTTP client.
• The recursive call continues the token request flow and signs the next request for the redirected destination.

Reachable in production

consumer = OAuth::Consumer.new(
 consumer key,
 consumer secret,
 site: "https://provider.example"
)

request token = consumer.get request token

Reproduction

consumer = OAuth::Consumer.new(
 consumer key,
 consumer secret,
 site: "https://provider.example"
)

consumer.get request token

• the token request leaves the configured OAuth provider origin;
• the redirected host receives a signed OAuth 1 token request;
• the application does not get a chance to inspect or approve the redirect target before the redirected request is sent.

• same-origin redirects continue to work, subject to a redirect limit;
• cross-origin token endpoint redirects are rejected by default;
• applications that intentionally require cross-origin token redirects must opt in explicitly with token request cross origin redirects.

Suggested fix

current uri = token request uri(path)
redirected uri = token request redirect uri(current uri, response)
response.error! unless redirected uri

redirect count = request options[:token request redirect count].to i + 1
response.error! if redirect count > token request max redirects(request options)
response.error! if token request cross origin?(current uri, redirected uri) &&
 !token request cross origin redirects?(request options)

redirect options = request options.merge(token request redirect count: redirect count)
token request(http method, token request redirect path(current uri, redirected uri), token, redirect options, *arguments, &block)

Workarounds

• Ensure configured OAuth token endpoints are fixed absolute URLs controlled by a trusted provider.
• Do not use tenant-controlled OAuth token endpoint URLs unless the tenant is trusted to receive signed OAuth token requests.
• Block outbound application-server traffic to internal metadata services and other sensitive internal addresses at the network layer.
• Place a trusted proxy in front of OAuth providers that rejects token endpoint redirects to a different origin.

Credit

References

• Related OAuth 2 advisory: https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9
• Fixed version: oauth v1.1.6
• Behavior-introducing commit: https://github.com/ruby-oauth/oauth/commit/d74b767f