CVE-2020-15233 - OpenCVE

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ory	Fosite

Configuration 1 [-]

cpe:2.3:a:ory:fosite:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf
https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-10-02T20:40:17

Updated: 2024-08-04T13:08:22.914Z

Reserved: 2020-06-25T00:00:00

Link: CVE-2020-15233

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-10-02T21:15:12.403

Modified: 2021-11-18T16:48:07.457

Link: CVE-2020-15233

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "fosite", "vendor": "ory", "versions": [{"status": "affected", "version": "< 0.34.1"}]}], "descriptions": [{"lang": "en", "value": "ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "{\"CWE-20\":\"Improper Input Validation\"}", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "description": "{\"CWE-601\":\"URL Redirection to Untrusted Site ('Open Redirect')\"}", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-02T20:40:17", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5"}], "source": {"advisory": "GHSA-rfq3-w54c-f9q5", "discovery": "UNKNOWN"}, "title": "OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-15233", "STATE": "PUBLIC", "TITLE": "OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "fosite", "version": {"version_data": [{"version_value": "< 0.34.1"}]}}]}, "vendor_name": "ory"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "{\"CWE-20\":\"Improper Input Validation\"}"}]}, {"description": [{"lang": "eng", "value": "{\"CWE-601\":\"URL Redirection to Untrusted Site ('Open Redirect')\"}"}]}]}, "references": {"reference_data": [{"name": "https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf", "refsource": "MISC", "url": "https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf"}, {"name": "https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5", "refsource": "CONFIRM", "url": "https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5"}]}, "source": {"advisory": "GHSA-rfq3-w54c-f9q5", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:08:22.914Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15233", "datePublished": "2020-10-02T20:40:17", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2024-08-04T13:08:22.914Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ory:fosite:*:*:*:*:*:*:*:*", "matchCriteriaId": "201C52D0-6A3D-4343-AC05-ED845D58450B", "versionEndExcluding": "0.34.1", "versionStartIncluding": "0.30.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1."}, {"lang": "es", "value": "ORY Fosite es el primer framework de seguridad OAuth2 y OpenID Connect para Go. En Fosite desde la versi\u00f3n 0.30.2 y versiones anteriores a 0.34.1, se presenta un problema en el que un atacante puede anular la URL de redireccionamiento registrada realizando un flujo de OAuth y solicitando una URL de redireccionamiento al adaptador de loopback. Los atacantes pueden proporcionar par\u00e1metros de consulta de URL personalizados a su URL de redireccionamiento de loopback, as\u00ed como tambi\u00e9n anular el host de la URL de redireccionamiento registrada. Estos ataques solo son aplicables en escenarios donde el atacante tiene acceso por medio de la interfaz de loopback. Esta vulnerabilidad ha sido parcheada en ORY Fosite versi\u00f3n v0.34.1"}], "id": "CVE-2020-15233", "lastModified": "2021-11-18T16:48:07.457", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-10-02T21:15:12.403", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}