PT-2022-8850 · Unknown · Apifest Oauth 2.0 Server

Published 2022-06-29 · Updated 2022-07-08 · CVE-2020-26877

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ApiFest OAuth 2.0 Server version 0.3.1

Description The issue concerns the failure to validate the redirect URI according to RFC 6749, making the server susceptible to an open redirector attack. An attacker can manipulate the redirect uri parameter to obtain a leaked authorization code when the server redirects the client to the manipulated URI.

Recommendations For ApiFest OAuth 2.0 Server version 0.3.1, consider implementing redirect URI validation to ensure it matches the registered URI of the client initiating the request, as a temporary workaround to prevent open redirector attacks. Restrict access to the authorization code endpoint to minimize the risk of exploitation. Avoid using the redirect uri parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-26877

Affected Products

Apifest Oauth 2.0 Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-26877 · Security Note
• http://apifest.org/index.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26877 · Vendor Advisory
• https://github.com/apifest/apifest-oauth20 · Note
• https://t.me/cibsecurity/45366 · Telegram Post
• https://tools.ietf.org/html/rfc6749#section-3.1.2.3 · Note