PT-2022-16883 · Unknown · Express Openid Connect

Jviding · Published 2022-03-31 · Updated 2022-04-08 · CVE-2022-24794

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Express OpenID Connect versions prior to 2.7.2

Description The issue affects users of the requiresAuth middleware, either directly or through the default authRequired option, making them vulnerable to an Open Redirect when the middleware is applied to a catch-all route. If all routes under a domain are protected with the requiresAuth middleware, a visit to a URL like http://example.com//google.com will be redirected to google.com after login because the original URL reported by the Express framework is not properly sanitized.

Recommendations For versions prior to 2.7.2, upgrade to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the requiresAuth middleware on catch-all routes until the upgrade is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-24794

GHSA-7P99-3798-F85C

Affected Products

Express Openid Connect

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24794.json · Exploit
• https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24794 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24794 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7p99-3798-f85c · Vendor Advisory
• https://github.com/auth0/express-openid-connect · Note
• https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c · Note
• https://t.me/cibsecurity/39953 · Telegram Post