CVE-2020-5409: Pivotal Concourse OAuth Redirect Vulnerability
Summary
CVE-2020-5409: Concourse Open Redirect in the /sky/login endpoint. Affects concourse across 3 version ranges.
< 5.2.8
>= 5.3.0, < 5.5.10
>= 5.6.0, < 5.8.1
Fixed in 5.2.8, 5.5.10 or 5.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pivotal Concourse is an open-source continuous integration and delivery platform. It provides a scalable and automated solution for building, testing, and deploying applications. Concourse allows users to authenticate using OAuth, which involves redirecting users to trusted websites for authentication. However, prior to version 6.0.0, Concourse had a vulnerability that allowed redirects to untrusted websites during the login flow. This could be exploited by a remote attacker to trick a user into clicking on a malicious link and gaining access to the user's access token in Concourse. It is important to note that this vulnerability is similar to, but distinct from, CVE-2018-15798.
Vulnerability Detail
The Pivotal Concourse OAuth Redirect Vulnerability allows an unauthenticated remote attacker to redirect users to untrusted websites during the login flow. By convincing a user to click on a specially crafted OAuth redirect link, the attacker can obtain the user's access token in Concourse. This access token can then be used to impersonate the user and perform unauthorized actions within the system. The vulnerability has a Medium severity rating with a CVSSv3 score of 6.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.2.85.2.8 -
>= 5.3.0, < 5.5.105.5.10 -
>= 5.6.0, < 5.8.15.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of Concourse to mitigate the risk.
Conclusion
The Pivotal Concourse OAuth Redirect Vulnerability allows an attacker to redirect users to untrusted websites and obtain their access tokens. To mitigate this vulnerability, it is crucial to upgrade to Concourse version 6.0.0 or later. This will ensure that the OAuth redirect flow is secure and protect users from potential unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concourse →
FAQ
Pivotal Concourse is an open-source continuous integration and delivery platform that provides a scalable and automated solution for building, testing, and deploying applications.
The vulnerability allows an attacker to redirect users to untrusted websites during the login flow and obtain their access tokens. This can lead to unauthorized access and potential misuse of user accounts within Concourse.
Yes, upgrading to Concourse version 6.0.0 or later includes a fix for this vulnerability. It is recommended to update to the latest available version to ensure protection.
No, there is no known workaround for this vulnerability. Upgrading to a fixed version is the only recommended solution.
Yes, this vulnerability is similar to CVE-2018-15798, but it is distinct and has its own CVE identifier (CVE-2020-5409). Both vulnerabilities involve redirects to untrusted websites during the login flow.
References
Related vulnerabilities
Recent vulnerabilities recorded for concourse.
