Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

Summary

When the Timeoutable module is enabled in Devise, the FailureApp#redirect_url method returns request.referrer — the HTTP Referer header, which is attacker-controllable — without validation for any non-GET request that results in a session timeout. An attacker who hosts a page with an auto-submitting cross-origin form can cause a victim with an expired Devise session to be redirected to an arbitrary external URL. This contrasts with the GET timeout path (which uses server-side attempted_path) and Devise's own store_location_for mechanism (which strips external hosts via extract_path_from_location), both of which are protected; only the non-GET timeout redirect path is unprotected.

Details

The vulnerable code is in lib/devise/failure_app.rb:

def redirect_url
  if warden_message == :timeout
    flash[:timedout] = true if is_flashing_format?

    path = if request.get?
      attempted_path          # safe: server-side value from warden options
    else
      request.referrer        # UNSAFE: HTTP Referer header, attacker-controlled
    end

    path || scope_url
  else
    scope_url
  end
end

This is passed directly to redirect_to:

def redirect
  store_location!
  # ...
  redirect_to redirect_url   # redirect_url may be an external attacker URL
end

The GET timeout path uses attempted_path, which is set server-side by Warden and cannot be influenced by the client. The method also only runs for GET requests, so no session-based protection is applied on POST timeouts.