Bug 1760613 (CVE-2019-14857) - CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
Summary: CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when using URLs ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14857
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1760614 1805067 1805068 1820666
Blocks: 1760615
TreeView+ depends on / blocked
 
Reported: 2019-10-10 23:17 UTC by Pedro Sampaio
Modified: 2021-02-16 21:16 UTC (History)
5 users (show)

Fixed In Version: mod_auth_openidc 2.4.0.1
Doc Type: If docs needed, set a value
Doc Text:
An open redirect flaw was discovered in mod_auth_openidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web site, which would redirect them to another possibly malicious URL.
Clone Of:
Environment:
Last Closed: 2020-07-21 19:27:48 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3032 0 None None None 2020-07-21 14:47:08 UTC
Red Hat Product Errata RHSA-2020:3970 0 None None None 2020-09-29 20:13:25 UTC

Description Pedro Sampaio 2019-10-10 23:17:13 UTC
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.

Upstream patch:

https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75
https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e
https://github.com/zmartzone/mod_auth_openidc/pull/451

References:

https://groups.google.com/forum/#!topic/mod_auth_openidc/boy1Ba3Gdk4

Comment 1 Pedro Sampaio 2019-10-10 23:17:37 UTC
Created mod_auth_openidc tracking bugs for this issue:

Affects: fedora-all [bug 1760614]

Comment 5 Riccardo Schirone 2020-02-19 20:12:47 UTC
The version of mod_auth_openidc as shipped with Red Hat Enterprise Linux 7 does not contain the patched code, however due to a missing check, this issue does not manifest as an Open Redirect flaw, but it triggers a NULL pointer dereference while parsing the logout URL. For this reason, the only impact on RHEL 7 is to Availability, because the httpd process would die, even though others can take other requests.

Comment 6 Riccardo Schirone 2020-02-19 20:22:55 UTC
Function oidc_handle_logout() in mod_auth_openidc.c takes care of handling requests like `https://server/redirect_uri?logout=<redirect-url>` and it uses function oidc_validate_post_logout_url() to validate the <redirect-url> (in some older versions of mod_auth_openidc the check is performed in the function oidc_handle_logout() itself). The checks are done by first parsing the URL with apr_uri_parse() and then by looking at the parsed values. However, some URLs may be incorrectly parsed by apr_uri_parse() and still be correctly used by browsers.

A remote attacker may use this flaw to trick a victim user into visiting a trusted vulnerable web site which, when handling a specially crafted URL, would redirect the victim to another malicious URL, possibly performing other kinds of attacks.

Comment 7 Riccardo Schirone 2020-02-20 08:04:49 UTC
Statement:

It is not possible to reproduce the open redirect vulnerability in the versions of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7, as a missing check makes the process crash, due to a NULL pointer dereference, instead of letting it continue with an invalid URL.

Comment 9 Jakub Hrozek 2020-02-20 17:18:13 UTC
(In reply to Riccardo Schirone from comment #7)
> Statement:
> 
> It is not possible to reproduce the open redirect vulnerability in the
> versions of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7, as a
> missing check makes the process crash, due to a NULL pointer dereference,
> instead of letting it continue with an invalid URL.

Thank you for the careful testing. Would you say that the crash constitutes a DoS instead?

Comment 10 Riccardo Schirone 2020-02-21 13:21:54 UTC
In reply to comment #9:
> (In reply to Riccardo Schirone from comment #7)
> > Statement:
> > 
> > It is not possible to reproduce the open redirect vulnerability in the
> > versions of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7, as a
> > missing check makes the process crash, due to a NULL pointer dereference,
> > instead of letting it continue with an invalid URL.
> 
> Thank you for the careful testing. Would you say that the crash constitutes
> a DoS instead?

I set the CVSS for rhel-7/mod_auth_openidc to 5.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, which means Availability Impact is set to Low. The httpd server indeed crashes, but the parent httpd process does not and it just spawns new httpd children processes. I would say you could have a Denial of Service if you keep crashing the server very quickly, but I believe it is still Low impact.

Comment 12 errata-xmlrpc 2020-07-21 14:47:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3032 https://access.redhat.com/errata/RHSA-2020:3032

Comment 13 Product Security DevOps Team 2020-07-21 19:27:48 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14857

Comment 14 errata-xmlrpc 2020-09-29 20:13:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3970 https://access.redhat.com/errata/RHSA-2020:3970


Note You need to log in before you can comment on or make changes to this bug.