PT-2020-14299 · Ory · Ory Fosite

Aeneasr + 1 · Published 2020-10-02 · Updated 2021-11-18 · CVE-2020-15233

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ORY Fosite versions 0.30.2 through 0.34.1

Description The issue allows an attacker to override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide custom URL query parameters to their loopback redirect URL, as well as override the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface.

Recommendations For versions 0.30.2 through 0.34.1, update to ORY Fosite v0.34.1 to resolve the issue. As a temporary workaround, consider restricting access to loopback interfaces to minimize the risk of exploitation. Avoid using custom URL query parameters in redirect URLs for loopback interfaces until the issue is resolved.

Fix

Open Redirect

RCE

Weakness Enumeration

CWE-601

CWE-20

Related Identifiers

CVE-2020-15233

GHSA-RFQ3-W54C-F9Q5

Affected Products

Ory Fosite

References · 7

• https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf · Patch
• https://osv.dev/vulnerability/GHSA-rfq3-w54c-f9q5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15233 · Security Note
• https://github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5 · Note
• https://github.com/ory/fosite/pull/400 · Note
• https://github.com/ory/fosite · Note