ORY Fosite up to 0.34.1 Redirect Parameter redirect

Summaryinfo

A vulnerability was found in ORY Fosite up to 0.34.1. It has been classified as critical. This impacts an unknown function of the component Redirect Handler. Performing a manipulation as part of Parameter results in redirect. This vulnerability is reported as CVE-2020-15233. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ORY Fosite up to 0.34.1. This affects an unknown code block of the component Redirect Handler. The manipulation as part of a Parameter leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

The weakness was disclosed 10/02/2020 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2020-15233 since 06/25/2020. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 0.30.2 eliminates this vulnerability.

The entry VDB-162238 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• ORY Fosite

Version

• 0.34.0
• 0.34.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion