Vulnerability · Published Oct 2, 2020 · Assigned by GitHub_M

CVE-2020-15233OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

Medium 6.1

In plain English

A medium-severity improper input validation in fosite from ory. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.8%top 43.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/ory/fosite	0.34.1	GHSA-rfq3-w54c-f9q5

Affected products (as reported)

Vendor	Product	Versions
ory	fosite	< 0.34.1

Weakness: CWE-20, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf x_refsource_MISC
https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5 x_refsource_CONFIRM