PT-2024-28632 · Duende+1 · Duende Identityserver+1

Josephdecock · Published 2024-07-31 · Updated 2024-08-01 · CVE-2024-39694

Positive Technologies · (AI Summary)

CVSS v4.0

5.1

Medium

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Duende IdentityServer versions 5.1 and earlier Duende IdentityServer versions 6.0 through 6.0.4 Duende IdentityServer versions 6.1 through 6.1.7 Duende IdentityServer versions 6.2 through 6.2.4 Duende IdentityServer versions 6.3 through 6.3.9 Duende IdentityServer versions 7.0 through 7.0.5 All versions of IdentityServer4

Description It is possible for an attacker to craft malicious URLs that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a URL is returned as a redirect, some browsers will follow it to a third-party, untrusted site. This issue does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens by itself. However, an attacker could exploit this issue as part of a phishing attack designed to steal user credentials. The DefaultIdentityServerInteractionService methods GetAuthorizationContextAsync and IsValidReturnUrl may return non-null and true for malicious URLs, indicating incorrectly that they can be safely redirected to. Other vulnerable methods include ServerUrlExtensions.GetIdentityServerRelativeUrl, ReturnUrlParser.ParseAsync, OidcReturnUrlParser.ParseAsync, ReturnUrlParser.IsValidReturnUrl, and OidcReturnUrlParser.IsValidReturnUrl.

Recommendations For Duende IdentityServer versions 5.1 and earlier, and all versions of IdentityServer4, consider updating to a supported version of Duende IdentityServer. For Duende IdentityServer versions 6.0 through 6.0.4, update to version 6.0.5 or later. For Duende IdentityServer versions 6.1 through 6.1.7, update to version 6.1.8 or later. For Duende IdentityServer versions 6.2 through 6.2.4, update to version 6.2.5 or later. For Duende IdentityServer versions 6.3 through 6.3.9, update to version 6.3.10 or later. For Duende IdentityServer versions 7.0 through 7.0.5, update to version 7.0.6 or later. If upgrading is not possible, use IUrlHelper.IsLocalUrl from ASP.NET Core to validate return URLs in user interface code in the IdentityServer host.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-39694

GHSA-55P7-V223-X366

GHSA-FF4Q-64JC-GX98

Affected Products

Asp.Net Core

Duende Identityserver

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39694.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39694 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39694 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ff4q-64jc-gx98 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55p7-v223-x366 · Vendor Advisory
• https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366 · Note
• https://github.com/IdentityServer/IdentityServer4 · Note
• https://github.com/DuendeSoftware/IdentityServer · Note
• https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6 · Note
• https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a · Note
• https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e · Note
• https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1 · Note
• https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98 · Note
• https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011 · Note
• https://t.me/cvenotify/88204 · Telegram Post