CVE-2025-57821: Google Sign-In for Rails allowed redirects to malformed URLs
4.2
Basic Information
RubyTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| google_sign_in | rubygems | < 1.3.0 | 1.3.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The analysis of the security advisory and the associated commit a0548a604fb17e4eb1a57029f0d87e34e8499623 clearly points to a single vulnerable function. The vulnerability, an open redirect (CWE-601), is caused by improper validation of the redirect URL within the ensure_same_origin method in lib/google_sign_in/redirect_protector.rb. The diff shows that the original implementation had a logical flaw: it would only raise a violation for blank URLs or for well-formed URLs that had a different origin. It did not account for malformed URLs that would fail the well-formed check (target =~ QUALIFIED_URL_PATTERN) and thus pass validation, leading to the vulnerability. The patch rectifies this by implementing a strict whitelist, only permitting URLs that are either valid and same-origin or are absolute paths. Any other format, including the malformed URLs that could be used for exploitation, will now raise a violation. The new test cases added in test/models/redirect_protector_test.rb explicitly check for this malformed URL scenario, confirming the nature of the fix. Therefore, the root cause is localized to the GoogleSignIn::RedirectProtector.ensure_same_origin function.