Vulnerability · Published Oct 2, 2020 · Assigned by GitHub_M
CVE-2020-15234Redirect URL matching ignores character casing
Medium 6.1
In plain English
A medium-severity improper input validation in fosite from ory. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared with a simple string match. This allows an attacker to register a client with allowed redirect URL https://example.com/callback. Then perform an OAuth2 flow and requesting redirect URL https://example.com/CALLBACK. Instead of an error (invalid redirect URL), the browser is redirected to https://example.com/CALLBACK with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow (the user might still deny the request for example). This vulnerability has been patched in ORY Fosite v0.34.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ory/fosite | 0.34.1 | GHSA-grfp-q2mm-hfp6 |
Affected products (as reported)
Weakness: CWE-20, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/ory/fosite/security/advisories/GHSA-grfp-q2mm-hfp6 x_refsource_CONFIRM
- https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf x_refsource_MISC