Описание
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.
A flaw was found in oauthlib. When JSON with Padding (JSONP) support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback value, allowing the execution of arbitrary JavaScript code within the security context of client applications consuming the response.
Отчет
This vulnerability is rated as Moderate impact because successful exploitation requires a non-default configuration alongside user interaction to execute injected script within the client application's origin. In typical deployments, JSONP processing is disabled by default within oauthlib, leaving standard configurations unaffected. Exposure is limited to custom services that explicitly activate JSONP handling on the token revocation endpoint and process untrusted callback inputs.
Меры по смягчению последствий
JSONP support on oauthlib's token revocation endpoint is opt-in and disabled by default. Deployments can mitigate this issue by not enabling it: ensure enable_jsonp=True is not passed when constructing oauthlib's RevocationEndpoint, so that user-supplied callback parameters are never reflected into JavaScript response bodies. Upstream removed the JSONP feature from RevocationEndpoint entirely in oauthlib 4.0.0.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-podvm-builder-rhel9 | Fix deferred | ||
| Fence Agents Remediation Operator | workload-availability/fence-agents-remediation-rhel9-operator | Fix deferred | ||
| Lightspeed Core | lightspeed-core/lightspeed-stack-rhel9 | Fix deferred | ||
| Lightspeed Services for Advanced Cluster Management | lightspeed-services-acm/ocp-rules-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-rhel9-operator | Fix deferred | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-rhel8-operator | Fix deferred | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-rhel9-operator | Fix deferred | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 | Fix deferred | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Fix deferred | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
OAuthLib is an implementation of the OAuth request-signing logic for P ...
EPSS
6.1 Medium
CVSS3