CVE-2020-15233
published 2020-10-02CVE-2020-15233: ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an…
PriorityP421medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.80%
51.9th percentile
ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | ory_fosite | >= 0.30.3 < 0.34.1 | 0.34.1 |
| ory | fosite | < 0.34.1 | 0.34.1 |
| ory | fosite | >= 0.30.2 < 0.34.1 | 0.34.1 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
ghsa·2021-05-24
CVE-2020-15233 [MEDIUM] CWE-20 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
### Impact
[fosite#400](https://github.com/ory/fosite/pull/400) (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces ([rfc8252#section-7.3](https://tools.ietf.org/html/rfc8252#section-7.3)). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters
1. Registering a client with allowed redirect URL `http://127.0.0.1/callback`
2. Performing OAuth2 flow and requesting redirect URL `http://127.0.0.1/callback?bar=foo`
3. Instead of an error, the browser is redirected to `http://127.0.0.1/callback?bar=foo` with a potentially successful OAuth2 response.
OSV
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
osv·2021-05-24
CVE-2020-15233 [MEDIUM] OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
### Impact
[fosite#400](https://github.com/ory/fosite/pull/400) (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces ([rfc8252#section-7.3](https://tools.ietf.org/html/rfc8252#section-7.3)). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters
1. Registering a client with allowed redirect URL `http://127.0.0.1/callback`
2. Performing OAuth2 flow and requesting redirect URL `http://127.0.0.1/callback?bar=foo`
3. Instead of an error, the browser is redirected to `http://127.0.0.1/callback?bar=foo` with a potentially successful OAuth2 response.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-10-02
Published