CVE-2018-15798: Open Redirect in github.com/concourse/concourse/skymarshal/skyserver
Summary
CVE-2018-15798: Pivotal Concourse Open Redirect in Login Flow. Affects github.com/concourse/concourse across 3 version ranges.
< 5.2.8
>= 5.3.0, < 5.5.10
>= 5.6.0, < 5.8.1
Fixed in 5.2.8, 5.5.10 or 5.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/concourse/concourse/skymarshal/skyserver is a component of Pivotal Concourse Release, versions 4.x prior to 4.2.2. It is responsible for handling the login flow in Concourse. Concourse is an open-source continuous integration and delivery platform that enables teams to automate their build, test, and deployment processes. The skyserver package provides OAuth functionality for user authentication. However, prior to version 4.2.2, it was vulnerable to an open redirect attack.
Vulnerability Detail
The vulnerability in the skyserver package allowed an attacker to perform an open redirect attack during the login flow. This means that a remote unauthenticated attacker could trick a user into clicking on a malicious link that redirects them to an untrusted website. By exploiting this vulnerability, the attacker could gain access to the user's access token in Concourse. This access token could then be used to perform unauthorized actions on behalf of the user, potentially compromising the integrity and confidentiality of the user's data.
How To Fix
Latest published version: v4.2.3+incompatible as of 23 Oct 2026
go get github.com/concourse/concourse@v4.2.3+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.2.85.2.8go get github.com/concourse/concourse@v5.2.8 -
>= 5.3.0, < 5.5.105.5.10go get github.com/concourse/concourse@v5.5.10 -
>= 5.6.0, < 5.8.15.8.1go get github.com/concourse/concourse@v5.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding clicking on suspicious or untrusted links, especially during the login flow of Concourse.
Conclusion
The vulnerability in the skyserver package of Pivotal Concourse Release, versions 4.x prior to 4.2.2, allowed for open redirect attacks during the login flow. Upgrading to fixed versions of the package (5.2.8, 5.5.10, or 5.8.1) is recommended to mitigate the risk. It is also important to exercise caution while clicking on links, especially during the login process. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/concourse/concourse →
FAQ
An open redirect attack is a type of security vulnerability that allows an attacker to redirect a user to a malicious website. This can be done by manipulating a URL parameter or using a crafted link that appears legitimate. The purpose of the attack is to trick the user into visiting the malicious website, which can lead to various consequences such as phishing, malware infection, or unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities in your software.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level. CVSS (Common Vulnerability Scoring System) is a standardized system for assessing the severity of security vulnerabilities. The score takes into account various factors such as the impact on confidentiality, integrity, and availability of the affected system.
There are no known public exploits for this vulnerability at the time of writing. However, it is always recommended to apply security patches and updates promptly to mitigate the risk of potential exploits.
For further support on vulnerability remediation and securing your Concourse installation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in addressing any security concerns.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/concourse/concourse.
