GHSA-qqxw-m5fj-f7gv

Опубликовано: 20 дек. 2021

Источник: github

Github: Прошло ревью

CVSS3: 5.9

Описание

The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect

Impact

An open redirect vulnerability has been found in oauth2_proxy. Anyone who uses oauth2_proxy may potentially be impacted.

For a context [detectify] have an in depth blog post about the potential impact of an open redirect. Particularly see the OAuth section.

tl;dr: People's authentication tokens could be silently harvested by an attacker. e.g: facebook.com/oauth.php?clientid=123&state=abc&redirect_url=https://yourdomain.com/red.php?url%3dhttps://attacker.com/

Patches

@sauyon found the issue, and has submitted a patch.

diff --git a/oauthproxy.go b/oauthproxy.go index 72ab580..f420df6 100644 --- a/oauthproxy.go +++ b/oauthproxy.go @@ -517,7 +517,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error) // IsValidRedirect checks whether the redirect URL is whitelisted func (p *OAuthProxy) IsValidRedirect(redirect string) bool { switch { - case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"): + case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"): return true case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"): redirectURL, err := url.Parse(redirect)

This patch will be applied to the next release, which is scheduled for when this is publicly disclosed.

Workarounds

At this stage there is no work around.

Ссылки

Пакеты

Наименование

github.com/oauth2-proxy/oauth2-proxy

Затронутые версииВерсия исправления

< 5.0.0

5.0.0

EPSS

Процентиль: 52%

0.00287

Низкий

5.9 Medium

CVSS3

CVE ID

CVE-2020-5233

Дефекты

CWE-601

Связанные уязвимости

CVE-2020-5233

CVSS3: 5.9

nvd

около 6 лет назад

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.

CVE-2020-5233

CVSS3: 5.9

debian

около 6 лет назад

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentica ...

EPSS

Процентиль: 52%

0.00287

Низкий

5.9 Medium

CVSS3

CVE ID

CVE-2020-5233

Дефекты

CWE-601