CVE-2025-58067

{
  "id": "CVE-2025-58067",
  "sourceIdentifier": "[email protected]",
  "published": "2025-08-29T21:15:36.480",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the \"proceed_to\" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds."
    },
    {
      "lang": "es",
      "value": "Google Sign-In de Basecamp añade el inicio de sesión de Google a las aplicaciones Rails. Antes de la versión 1.3.1, es posible redirigir a un usuario a otro origen si el valor “proceed_to” en el almacén de la sesión se establece como una URL relativa al protocolo. Normalmente, el valor de esta URL solo es escrito y leído por la biblioteca o la aplicación que realiza la llamada. Sin embargo, puede ser posible establecer este valor de la sesión desde un sitio malicioso mediante el envío de un formulario. Cualquier aplicación Rails que utilice la gema google_sign_in puede ser vulnerable, si este vector puede encadenarse con otro ataque que sea capaz de modificar los parámetros de la solicitud OAuth2. Este problema ha sido parcheado en la versión 1.3.1. No hay soluciones alternativas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "basecamp",
          "product": "google_sign_in",
          "versions": [
            {
              "version": "< 1.3.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T13:52:36.468526Z",
          "id": "CVE-2025-58067",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/basecamp/google_sign_in/pull/75",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v",
      "source": "[email protected]"
    }
  ]
}