Bug 1986102 (CVE-2021-32786) - CVE-2021-32786 mod_auth_openidc: open redirect in oidc_validate_redirect_url()
Summary: CVE-2021-32786 mod_auth_openidc: open redirect in oidc_validate_redirect_url()
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-32786
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1986103 1987203 1987204
Blocks: 1986104
TreeView+ depends on / blocked
 
Reported: 2021-07-26 17:09 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-05-11 02:46 UTC (History)
6 users (show)

Fixed In Version: mod_auth_openidc 2.4.9
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in mod_auth_openidc where it does not sanitize redirection URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2022-05-11 02:46:27 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:1823 0 None None None 2022-05-10 13:39:55 UTC

Description Guilherme de Almeida Suckevicz 2021-07-26 17:09:38 UTC 
In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG).

References:
https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-xm4c-5wm5-jqv7
https://daniel.haxx.se/blog/2017/01/30/one-url-standard-please/
https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9

Upstream patch:
https://github.com/zmartzone/mod_auth_openidc/commit/3a115484eb927bc6daa5737dd84f88ff4bbc5544
Comment 1 Guilherme de Almeida Suckevicz 2021-07-26 17:09:52 UTC 
Created mod_auth_openidc tracking bugs for this issue:

Affects: fedora-all [bug 1986103]
Comment 3 Riccardo Schirone 2021-07-29 08:28:41 UTC 
Upstream they suggested as a workaround to configure configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression, through the use of OIDCRedirectURLsAllowed, however that feature was only introduced in upstream version of mod_auth_openidc 2.4.3. The latest version of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7 and 8 is older than 2.4.3 and it does not support OIDCRedirectURLsAllowed, thus no mitigation can be applied on those systems.
Comment 5 errata-xmlrpc 2022-05-10 13:39:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1823 https://access.redhat.com/errata/RHSA-2022:1823
Comment 6 Product Security DevOps Team 2022-05-11 02:46:25 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-32786
Note You need to log in before you can comment on or make changes to this bug.