PT-2020-14300 · Ory · Ory Fosite

Mitar · Published 2020-10-02 · Updated 2021-11-18 · CVE-2020-15234

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ORY Fosite versions prior to 0.34.1

Description The issue arises from the comparison of the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint using strings.ToLower instead of a simple string match. This allows an attacker to register a client with an allowed redirect URL, such as https://example.com/callback, and then perform an OAuth2 flow requesting a redirect URL like https://example.com/CALLBACK. As a result, the browser is redirected to https://example.com/CALLBACK with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow.

Recommendations For versions prior to 0.34.1, update to ORY Fosite version 0.34.1 to resolve the issue. As a temporary workaround, consider disabling the OAuth2 flow for clients with registered redirect URLs that may be exploited until a patch is applied. Restrict access to the OAuth2 Authorization Endpoint to minimize the risk of exploitation. Avoid using case-insensitive comparisons for redirect URLs in the affected OAuth2 flow until the issue is resolved.

Fix

Open Redirect

RCE

Weakness Enumeration

CWE-178

CWE-601

CWE-20

Related Identifiers

CVE-2020-15234

GHSA-GRFP-Q2MM-HFP6

Affected Products

Ory Fosite

References · 6

• https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf · Patch
• https://osv.dev/vulnerability/GHSA-grfp-q2mm-hfp6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15234 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15234 · Vendor Advisory
• https://github.com/ory/fosite/security/advisories/GHSA-grfp-q2mm-hfp6 · Note
• https://github.com/ory/fosite · Note