PT-2022-8851 · Unknown · Oauth2-Server

Tamjidrahat · Published 2022-08-29 · Updated 2022-09-07 · CVE-2020-26938

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions oauth2-server (aka node-oauth2-server) versions 3.1.1 and earlier

Description The issue arises from an incorrect URI pattern ([a-zA-Z][a-zA-Z0-9+.-]+:) used to check the redirect uri parameter during authorization and token requests. This flaw allows a malicious client to inject an XSS payload through the redirect uri parameter, potentially leading to security breaches.

Recommendations For versions 3.1.1 and earlier, update to a version later than 3.1.1 to resolve the issue. As a temporary workaround, consider validating the redirect uri parameter against a correct URI pattern to prevent malicious redirects.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-26938

GHSA-4RG6-FM25-GC34

Affected Products

Oauth2-Server

References · 10

• 🔥 https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143 · Exploit
• 🔥 https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26938 · Security Note
• https://osv.dev/vulnerability/GHSA-4rg6-fm25-gc34 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26938 · Vendor Advisory
• https://github.com/oauthjs/node-oauth2-server/issues/637 · Note
• https://github.com/oauthjs/node-oauth2-server · Note
• https://tools.ietf.org/html/rfc3986#section-3 · Note
• https://t.me/cvenotify/35829 · Telegram Post
• https://tools.ietf.org/html/rfc6749#section-3.1.2 · Note