CVE-2025-58067: Basecamp Google Sign-In Auth Bypass Flaw

CVE-2025-58067 Overview

CVE-2025-58067 is an open redirect vulnerability [CWE-601] in Basecamp's google_sign_in gem, which adds Google sign-in to Rails applications. Versions prior to 1.3.1 accept a protocol-relative URL in the proceed_to session value, allowing redirection to an attacker-controlled origin. Although the value is normally written and read only by the library or calling application, a malicious site can plant it via a form submission. Exploitation requires chaining with another flaw capable of modifying the OAuth2 request parameters. The maintainers released version 1.3.1 with a fix, and there are no workarounds.

Critical Impact
Attackers can redirect authenticated users to attacker-controlled origins during the Google OAuth2 sign-in flow, enabling phishing and credential theft in Rails applications that depend on google_sign_in.

Affected Products

Basecamp google_sign_in gem versions prior to 1.3.1
Rails applications integrating google_sign_in for Google OAuth2 authentication
Deployments where OAuth2 request parameters can be modified by an external actor

Discovery Timeline

2025-08-29 - CVE-2025-58067 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58067

Vulnerability Analysis

The google_sign_in gem uses a RedirectProtector module to validate that post-authentication redirect targets share the same origin as the source request. The ensure_same_origin method previously accepted any target matching URI::DEFAULT_PARSER.regexp[:ABS_PATH], including protocol-relative URLs beginning with //. Browsers interpret protocol-relative URLs as cross-origin, so a value like //attacker.example bypasses the same-origin check while still matching the absolute-path pattern.

An attacker seeds the proceed_to session key with a crafted value by luring a victim to submit a form to the target application. When the victim later completes Google sign-in, the application reads proceed_to and issues a redirect to the attacker-controlled origin. The vulnerability is a redirect primitive, not a direct account takeover, and requires a companion flaw that can influence the OAuth2 request to reach full exploitation.

Root Cause

The root cause is incomplete input validation in the same-origin check. The regex for absolute paths matched protocol-relative URLs, and the code did not verify that the target lacked a host component or a leading //. This allowed off-origin redirects to satisfy the validator.

Attack Vector

The attack requires user interaction and network access. A victim must visit a malicious page that submits a form to the vulnerable Rails application, planting a protocol-relative URL in the session. A subsequent modification of the OAuth2 request parameters must occur to reach the redirect sink after authentication.

ruby

# Patch: lib/google_sign_in/redirect_protector.rb
# Source: https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc
QUALIFIED_URL_PATTERN = /\A#{URI::DEFAULT_PARSER.make_regexp}\z/

def ensure_same_origin(target, source)
  unless uri_same_origin?(target, source) || absolute_path?(target)
    raise Violation, "Redirect target #{target.inspect} does not have same origin as request #{source.inspect}"
  end
end

private
  def uri_same_origin?(target, source)
    target =~ QUALIFIED_URL_PATTERN && origin_of(target) == origin_of(source)
  rescue ArgumentError, URI::Error
    false
  end

  def absolute_path?(target)
    target =~ URI::DEFAULT_PARSER.regexp[:ABS_PATH] && URI(target).host.nil? && !target.start_with?("//")
  rescue ArgumentError, URI::Error
    false
  end

The fix rejects targets that start with // and requires the parsed URI to have no host component, closing the protocol-relative URL bypass.

Detection Methods for CVE-2025-58067

Indicators of Compromise

HTTP responses containing Location: headers pointing to external domains following /auth/google_oauth2 callbacks
Session proceed_to values beginning with // observed in application logs or Rails session stores
Form submissions from external referrers that write to the OAuth2 session state

Detection Strategies

Inventory Rails applications using the google_sign_in gem and compare installed versions against 1.3.1 using bundle list or Gemfile.lock review
Instrument the OAuth2 callback controller to log the proceed_to value before redirect and alert on values containing // or an external host
Review CSRF and same-site cookie protections on any endpoint that writes to the OAuth2 session

Monitoring Recommendations

Monitor outbound redirects from authentication endpoints and flag redirects to domains outside the application's allowlist
Alert on repeated 302 responses from /auth/* routes to unique external hosts within short time windows
Track requests with cross-origin Referer headers that write to session storage tied to authentication flows

How to Mitigate CVE-2025-58067

Immediate Actions Required

Upgrade the google_sign_in gem to version 1.3.1 or later and redeploy affected Rails applications
Audit application code for additional sinks that consume proceed_to or similar session values without origin validation
Verify that any endpoint writing to the OAuth2 session enforces CSRF protection and SameSite cookies

Patch Information

The fix is available in GitHub Release v1.3.1 via Pull Request #75 and commit e97aef4. Details are documented in GHSA-5jch-xhw4-r43v.

Workarounds

No workarounds are provided by the maintainers; upgrading to 1.3.1 is required
As a defense-in-depth measure, application-level allowlists can validate redirect targets against a set of known internal paths

bash

# Update the gem in your Rails application
bundle update google_sign_in --conservative

# Verify the installed version
bundle info google_sign_in | grep -i version

# Confirm Gemfile.lock reflects >= 1.3.1
grep google_sign_in Gemfile.lock