CVE-2020-15233

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

Impact

fosite#400 (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces (rfc8252#section-7.3). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters

1. Registering a client with allowed redirect URL http://127.0.0.1/callback
2. Performing OAuth2 flow and requesting redirect URL http://127.0.0.1/callback?bar=foo
3. Instead of an error, the browser is redirected to http://127.0.0.1/callback?bar=foo with a potentially successful OAuth2 response.

as well as the host parameter (as long as the host is a loopback interface):

1. Registering a client with allowed redirect URL https://example.com/callback
2. Performing OAuth2 flow and requesting redirect URL http://127.0.0.1/callback
3. Instead of an error, the browser is redirected to http://127.0.0.1/callback with a potentially successful OAuth2 response.

These bugs are only applicable in scenarios where the attacker has control over the loopback interface (localhost, 127.0.0.1, [::1]) where the browser performing the OAuth2 flow is running.

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

Impact

fosite#400 (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces (rfc8252#section-7.3). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters

1. Registering a client with allowed redirect URL http://127.0.0.1/callback
2. Performing OAuth2 flow and requesting redirect URL http://127.0.0.1/callback?bar=foo
3. Instead of an error, the browser is redirected to http://127.0.0.1/callback?bar=foo with a potentially successful OAuth2 response.

as well as the host parameter (as long as the host is a loopback interface):

1. Registering a client with allowed redirect URL https://example.com/callback
2. Performing OAuth2 flow and requesting redirect URL http://127.0.0.1/callback
3. Instead of an error, the browser is redirected to http://127.0.0.1/callback with a potentially successful OAuth2 response.

These bugs are only applicable in scenarios where the attacker has control over the loopback interface (localhost, 127.0.0.1, [::1]) where the browser performing the OAuth2 flow is running.