CVE-2025-57821

Executive Summary

CVE-2025-57821 is a medium-severity open redirect vulnerability in the basecamp/google_sign_in Ruby gem, which integrates Google Sign-In into Rails applications. The flaw allows an attacker to craft a malformed URL that bypasses the same-origin validation, redirecting a user to an attacker-controlled origin. While the direct impact is limited (CVSS 4.2), the vulnerability becomes critical when chained with a session cookie injection attack, potentially leading to session hijacking or data exposure. The issue is patched in version 1.3.0. As a temporary mitigation, setting SameSite=Lax or SameSite=Strict on the session cookie can prevent the chained attack vector.

Supply Chain & Package Security

This vulnerability affects the Ruby gem basecamp/google_sign_in, which is distributed via RubyGems. Organizations using this gem in their Rails applications should verify their dependency version and update to 1.3.0 or later. The gem is a direct dependency for applications integrating Google Sign-In, and its compromise could affect downstream users. No known supply chain attacks have been reported for this specific CVE, but the open redirect could be leveraged in phishing campaigns targeting users of affected applications.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests that exploitation is not currently widespread, but the chained attack vector with session cookie injection could elevate the risk in specific configurations.

Deep Dive & Mechanics

The vulnerability resides in the URL validation logic of the google_sign_in gem. The gem is designed to verify that the redirect URL after Google Sign-In originates from the same origin as the application. However, due to improper parsing of malformed URLs, an attacker can craft a URL that passes the same-origin check but actually redirects to a different origin.

For example, a URL like https://legitimate-app.com@attacker.com might be parsed incorrectly, where the @ symbol is interpreted as part of the userinfo component, causing the redirect to go to attacker.com while the origin check sees legitimate-app.com. This is a classic open redirect vulnerability (CWE-601).

The chained attack requires the Rails application to store flash messages in a session cookie. If an attacker can inject arbitrary data into the session cookie (e.g., via another vulnerability or misconfiguration), they could combine it with the open redirect to exfiltrate session data or perform session fixation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.3.0):

def same_origin?(uri)
  uri.host == request.host && uri.port == request.port && uri.scheme == request.scheme
end

This simple check does not account for malformed URLs where the host part is ambiguous.

Patched Code (1.3.0):

def same_origin?(uri)
  parsed_uri = URI.parse(uri.to_s)
  return false unless parsed_uri.host
  parsed_uri.host == request.host && parsed_uri.port == request.port && parsed_uri.scheme == request.scheme
end

The patch uses URI.parse to properly decompose the URL, ensuring that the host is extracted correctly and that malformed URLs are rejected.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Rails application using basecamp/google_sign_in < 1.3.0
• The application stores flash messages in a session cookie (default Rails behavior)
• Ability to craft a malformed URL

Exploitation Steps:

1. Identify the Google Sign-In callback URL (e.g., https://victim-app.com/auth/google/callback).
2. Craft a malformed redirect URL: https://victim-app.com@attacker.com/steal-session.
3. Send the crafted URL to a victim via phishing email or social engineering.
4. If the victim is logged in and clicks the link, they will be redirected to attacker.com after the Google Sign-In flow.
5. If the attacker can also inject data into the session cookie (e.g., via a separate XSS or CSRF), they can chain the attacks to steal the session.

Proof-of-Concept (PoC) Code:

import requests

# Craft malformed URL
malformed_url = "https://victim-app.com@attacker.com/steal-session"
# Send to victim (simplified)
print(f"Send this link to victim: {malformed_url}")

Blue Team

Detection Steps:

1. Monitor for unusual redirect patterns in web server logs, especially URLs containing @ or // in the path.
2. Check for unexpected Referer headers pointing to external domains after Google Sign-In.
3. Review session cookie configurations: ensure SameSite is set to Lax or Strict.
4. Verify that the google_sign_in gem is updated to version 1.3.0 or later.

Lab Setup:

• Use a vulnerable Rails application (e.g., a test app with google_sign_in 1.2.0).
• Set up a WAF or IDS to detect malformed URLs.
• Simulate the attack and verify detection rules.

Indicators of Compromise (IOCs)

• URL Patterns: URLs containing @ in the host portion (e.g., https://legitimate.com@evil.com)
• Web Server Logs: Unusual GET requests to /auth/google/callback with malformed state or redirect_uri parameters.
• Session Cookie Anomalies: Session cookies with unexpected SameSite values or unusual domain attributes.
• Network Traffic: Outbound connections to unknown domains shortly after Google Sign-In callbacks.

Detection Engineering

YARA Rule

rule Detect_Malformed_Redirect_URL {
  meta:
    description = "Detects malformed URLs used in CVE-2025-57821 open redirect"
    author = "Valters IT"
    date = "2025-01-01"
    reference = "CVE-2025-57821"
  strings:
    $url_pattern = /https?:\/\/[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\//
  condition:
    $url_pattern
}

Sigma Rule

title: Detection of Malformed Redirect URLs (CVE-2025-57821)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with malformed URLs containing '@' in the host portion
author: Valters IT
date: 2025-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains: "@"
  condition: selection
falsepositives:
  - Legitimate use of '@' in URL parameters (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-57821 Malformed Redirect URL Detected"; flow:to_server; content:"@"; http_uri; pcre:"/https?:\/\/[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the basecamp/google_sign_in gem to version 1.3.0 or later.
2. If upgrade is not possible, set SameSite=Lax or SameSite=Strict on the session cookie in config/initializers/session_store.rb:

   Rails.application.config.session_store :cookie_store, key: '_your_app_session', same_site: :lax
   

3. Review and harden session cookie configuration to prevent injection attacks.

Long-Term Measures:

• Implement strict URL validation for all redirects in the application.
• Use a web application firewall (WAF) to block malformed URLs.
• Conduct regular security audits of third-party gems and dependencies.
• Monitor for similar open redirect vulnerabilities in other components.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.