PT-2021-18228 · Authelia · Authelia

Clems4Ever · Published 2021-04-21 · Updated 2023-03-16 · CVE-2021-29456

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Authelia versions 4.27.4 and earlier

Description: The issue allows an attacker to redirect users from the web application to any domain, including potentially malicious sites, by utilizing a HTTP query parameter. This does not directly impact the security of the web application itself but can be used for phishing attempts, making them seem more trustworthy. The attacker can redirect users to malicious sites, taking advantage of the user's familiarity with the initial site and the actual URL.

Recommendations: For versions 4.27.4 and earlier, update to version 4.28.0, which includes a patch for this issue. As a temporary workaround, consider using a reverse proxy to strip the query parameter from the affected endpoint.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-29456

GHSA-36F2-FCRX-FP4J

Affected Products

Authelia

References · 5

• https://github.com/authelia/authelia/security/advisories/GHSA-36f2-fcrx-fp4j · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29456 · Security Note
• https://osv.dev/vulnerability/GHSA-36f2-fcrx-fp4j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29456 · Vendor Advisory
• https://github.com/authelia/authelia · Note