CVE-2022-24794: URL Redirection to Untrusted Site in express-openid-connect
Summary
CVE-2022-24794: URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect. Affects express-openid-connect versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
express-openid-connect is an npm package that provides OpenID Connect authentication and authorization middleware for Express.js applications. It allows developers to easily integrate OpenID Connect authentication into their Express.js applications. This vulnerability affects versions of express-openid-connect up to and including 2.7.1.
Vulnerability Detail
The vulnerability in express-openid-connect allows for URL redirection to an untrusted site, also known as an Open Redirect vulnerability. When the requiresAuth middleware is applied to a catch-all route, a user visiting a URL like http://example.com//google.com will be redirected to google.com after login. This occurs because the original URL reported by the Express framework is not properly sanitized. This vulnerability can be exploited if all routes under example.com are protected with the requiresAuth middleware.
How To Fix
Minimum fixed version
2.7.2
This is the first release that contains the fix.
npm install express-openid-connect@2.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of express-openid-connect to mitigate the risk.
Conclusion
The URL redirection vulnerability in express-openid-connect can be mitigated by upgrading to version 2.7.2 or later. It is important to promptly apply this update to prevent potential phishing attacks or unauthorized redirection of users to untrusted sites. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for express-openid-connect →
FAQ
You are affected by this vulnerability if you are using the requiresAuth middleware on a catch-all route or the default authRequired option and express-openid-connect version <=2.7.1.
The impact of this vulnerability is that an attacker can craft a malicious URL that redirects users to an untrusted site after login. This can be used for phishing attacks or to trick users into visiting malicious websites.
To fix this vulnerability, you should upgrade to version >=2.7.2 of express-openid-connect. This update includes a patch that properly sanitizes the original URL to prevent URL redirection to untrusted sites.
No, the fix provided in the patch will not affect your users. It only addresses the URL redirection vulnerability and does not introduce any breaking changes.
You can find more information about this vulnerability in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-7p99-3798-f85c/GHSA-7p99-3798-f85c.json
References
Related vulnerabilities
Recent vulnerabilities recorded for express-openid-connect.
