Vulnerability · Published Jul 31, 2024 · Assigned by GitHub_M
CVE-2024-39694Duende IdentityServer Open Redirect vulnerability
Medium 4.7
In plain English
A medium-severity open redirect in IdentityServer from DuendeSoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | duende.identityserver | 7.0.6 | GHSA-ff4q-64jc-gx98 |
| NuGet | duende.identityserver | 6.3.10 | GHSA-ff4q-64jc-gx98 |
| NuGet | duende.identityserver | 6.2.5 | GHSA-ff4q-64jc-gx98 |
| NuGet | duende.identityserver | 6.1.8 | GHSA-ff4q-64jc-gx98 |
| NuGet | duende.identityserver | 6.0.5 | GHSA-ff4q-64jc-gx98 |
| NuGet | identityserver4 | no fix listed | GHSA-ff4q-64jc-gx98 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DuendeSoftware | IdentityServer | < 6.0.5>= 6.1.0-preview.1, <= 6.1.7>= 6.2.0-preview.1, <= 6.2.4>= 6.3.0-preview.1, <= 6.3.9>= 7.0.0-preview.1, <= 7.0.5 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
References
- https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98 x_refsource_CONFIRM
- https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6 x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1 x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011 x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a x_refsource_MISC