Vulnerability · Published Feb 2, 2021 · Assigned by GitHub_M
CVE-2021-21291Subdomain checking of whitelisted domains could allow unintended redirects
Medium 4.7
In plain English
A medium-severity open redirect in oauth2-proxy from oauth2-proxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/oauth2-proxy/oauth2-proxy | no fix listed | GHSA-4mf2-f3wh-gvf2 |
| Go | github.com/oauth2-proxy/oauth2-proxy | no fix listed | GO-2022-0790 |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 7.0.0 | GHSA-4mf2-f3wh-gvf2 |
| Go | github.com/oauth2-proxy/oauth2-proxy/v7 | 7.0.0 | GO-2022-0790 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| oauth2-proxy | oauth2-proxy | < 7.0.0 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2 x_refsource_CONFIRM
- https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0 x_refsource_MISC
- https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7 x_refsource_MISC
- https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725 x_refsource_MISC