CVE-2020-26938: oauth2-server through 3.1.1 Open Redirect Vulnerability
Summary
CVE-2020-26938: oauth2-server through 3.1.1 vulnerable to Open Redirect. Affects oauth2-server versions < 3.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The oauth2-server (aka node-oauth2-server) is an npm package that provides an OAuth 2.0 server implementation for Node.js. It allows developers to easily add OAuth 2.0 authentication and authorization capabilities to their Node.js applications. The package is widely used in various web applications and APIs to secure user access and protect sensitive data. However, versions up to 3.1.1 of oauth2-server are vulnerable to an Open Redirect vulnerability.
Vulnerability Detail
The Open Redirect vulnerability in oauth2-server arises from an incorrect URI pattern check for the redirect_uri parameter during the authorization and token request. The package checks the redirect_uri value against the pattern [a-zA-Z][a-zA-Z0-9+.-]+: before performing a redirection. However, this pattern is not sufficient to prevent malicious clients from passing an XSS payload through the redirect_uri parameter during an authorization request. This vulnerability allows an attacker to craft a malicious URL that, when clicked by a victim, redirects them to a website under the attacker's control, potentially leading to further exploitation or phishing attacks. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of oauth2-server as soon as possible.
Conclusion
In conclusion, oauth2-server versions up to 3.1.1 are vulnerable to an Open Redirect vulnerability. This can allow an attacker to craft a malicious URL that redirects victims to a website under the attacker's control. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of oauth2-server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oauth2-server →
FAQ
oauth2-server is an npm package that provides an OAuth 2.0 server implementation for Node.js. It allows developers to add OAuth 2.0 authentication and authorization capabilities to their Node.js applications.
An Open Redirect vulnerability occurs when a web application or API allows an attacker to craft a URL that, when clicked by a victim, redirects them to a website under the attacker's control. This can be exploited for phishing attacks or further exploitation.
The impact of this vulnerability is that an attacker can craft a malicious URL that, when clicked by a victim, redirects them to a website under the attacker's control. This can lead to further exploitation or phishing attacks.
To fix this vulnerability, upgrade to a version of oauth2-server beyond 3.1.1. The maintainers have addressed this issue in later releases by implementing a more secure URI pattern check for the redirect_uri parameter.
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of oauth2-server.
Related vulnerabilities
Recent vulnerabilities recorded for oauth2-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
