CVE-2025-58067: 
Ruby vulnerability analysis and mitigation

CVE-2025-58067 is an open redirect vulnerability in Basecamp's google_sign_in RubyGem, which adds Google Sign-In to Rails applications. The flaw allows an attacker to redirect authenticated users to an arbitrary external origin by setting the proceed_to session value to a protocol-relative URL (e.g., //evil.example.org), which improperly bypasses the library's same-origin check. All versions of the gem prior to 1.3.1 are affected. Disclosed and patched on August 29, 2025, it carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Advisory).

The root cause is improper input validation in the RedirectProtector#ensure_same_origin method (CWE-601: URL Redirection to Untrusted Site). The gem persists a proceed_to URL in the Rails session store and redirects the user to it after successful Google OAuth2 authentication. Prior to the fix, the same-origin check used URI::DEFAULT_PARSER.regexp[:ABS_PATH] to allow absolute paths, but this regex also matched protocol-relative URLs beginning with // (e.g., //evil.example.org), which browsers interpret as fully qualified external URLs. The fix in commit e97aef4 introduces an explicit absolute_path? method that additionally verifies the parsed URI has no host component and does not start with //, closing the bypass (GitHub Commit, GitHub Advisory). Exploitation requires chaining this flaw with another attack capable of injecting or modifying the proceed_to session parameter — for example, via a cross-site form submission from a malicious page (Basecamp Advisory).

Successful exploitation can result in a victim being silently redirected to an attacker-controlled site immediately after completing Google authentication, potentially exposing OAuth tokens, session cookies, or other authentication artifacts to the malicious origin. The confidentiality and integrity impacts are rated low, as the attack does not directly compromise the application server or its data, but can facilitate credential theft or phishing when chained with additional techniques. Availability is not impacted (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The vulnerability was responsibly disclosed via HackerOne by researcher muntrive and requires high attack complexity — specifically, the ability to chain it with a separate attack to manipulate the OAuth2 session parameters. The EPSS score is approximately 0.059% (19th percentile), indicating a low near-term exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify target application: Locate a Rails application using the google_sign_in gem (versions < 1.3.1) with Google Sign-In enabled and accessible from the internet.
2. Craft a malicious form: Create an HTML page on an attacker-controlled site with a form that submits a POST request to the target application's Google Sign-In authorization endpoint (e.g., /google_sign_in/authorizations), setting the proceed_to parameter to a protocol-relative URL such as //evil.example.org/capture.
3. Trigger session poisoning: Lure the victim to the malicious page (e.g., via phishing), causing their browser to submit the form cross-site, which writes the attacker-controlled proceed_to value into the victim's Rails session store.
4. Initiate OAuth flow: The victim is redirected through the Google OAuth2 flow as normal.
5. Capture post-authentication redirect: Upon successful authentication, the application reads the poisoned proceed_to value from the session, passes the same-origin check (due to the protocol-relative URL bypass), and redirects the victim to //evil.example.org/capture, where the attacker can harvest authentication tokens or session data (GitHub Advisory, Basecamp Advisory).

• Logs: Rails application logs showing POST requests to the Google Sign-In authorization endpoint with a proceed_to parameter value beginning with // (e.g., proceed_to=//evil.example.org/...) from unexpected referrer origins.
• Logs: Callback controller logs recording a redirect to an external or unexpected host immediately following a successful Google OAuth2 callback.
• Network: Outbound HTTP redirects (302 responses) from the application server to domains not belonging to the application's own origin, triggered by the OAuth callback endpoint.
• Session Store: Session entries where the proceed_to key contains a protocol-relative URL (starting with //) rather than an absolute path (starting with /).

Upgrade the google_sign_in gem to version 1.3.1 or later, which resolves the vulnerability by explicitly rejecting protocol-relative URLs and other invalid path formats in the RedirectProtector (GitHub Release). No configuration-based workarounds are available for unpatched versions (Basecamp Advisory). Update your Gemfile with gem 'google_sign_in', '>= 1.3.1' and run bundle update google_sign_in to apply the fix.