PT-2021-14393 · Unknown · Oauth2 Proxy

Semoac · Published 2021-02-02 · Updated 2024-08-21 · CVE-2021-21291

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: OAuth2 Proxy versions prior to 7.0.0

Description: The issue concerns the whitelist domain feature in OAuth2 Proxy, where a domain that ends similarly to the intended domain could be allowed as a redirect. For example, if a whitelist domain is configured for ".example.com", the intention is that subdomains of example.com are allowed, but "example.com" and "badexample.com" could also match. This is due to the code not matching a dot to ensure the redirect is a subdomain.

Recommendations: For versions prior to 7.0.0, update to version 7.0.0 or later to fix the issue. As a temporary workaround, consider disabling the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BIT-OAUTH2-PROXY-2021-21291

CVE-2021-21291

GHSA-4MF2-F3WH-GVF2

GO-2022-0790

Affected Products

Oauth2 Proxy

References · 10

• 🔥 https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2 · Exploit
• https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21291 · Security Note
• https://osv.dev/vulnerability/BIT-oauth2-proxy-2021-21291 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0790 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21291 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4mf2-f3wh-gvf2 · Vendor Advisory
• https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0 · Note
• https://t.me/cibsecurity/22971 · Telegram Post
• https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7 · Note