Vulnerability · Published May 7, 2020 · Assigned by GitHub_M
CVE-2020-11053Open Redirect in OAuth2 Proxy
High 7.1
In plain English
A high-severity open redirect in OAuth2 Proxy from OAuth2 Proxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. However, by crafting a redirect URL with HTML encoded whitespace characters the validation could be bypassed and allow a redirect to any URL provided. This has been patched in 5.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/oauth2-proxy/oauth2-proxy | 5.1.1 | GHSA-j7px-6hwj-hpjg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OAuth2 Proxy | OAuth2 Proxy | < 5.1.1 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L