CVE-2024-39694: IdentityServer Open Redirect vulnerability in Duende.IdentityServer
Summary
CVE-2024-39694: IdentityServer Open Redirect vulnerability. Affects Duende.IdentityServer across 5 version ranges.
>= 6.0.0-preview.1, < 6.0.5
>= 6.1.0-preview.1, < 6.1.8
>= 6.2.0-preview.1, < 6.2.5
>= 6.3.0-preview.1, < 6.3.10
>= 7.0.0-preview.1, < 7.0.6
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Duende.IdentityServer is an open-source package that provides a framework for building identity and access control solutions for web applications. It is commonly used to implement authentication and authorization mechanisms in ASP.NET Core applications. This package allows developers to secure their applications by integrating with various identity providers and managing user authentication and authorization. However, a vulnerability has been discovered in Duende.IdentityServer that could potentially allow attackers to craft malicious URLs and redirect users to untrusted sites.
Vulnerability Detail
The vulnerability in Duende.IdentityServer allows attackers to create malicious URLs that certain functions in IdentityServer incorrectly treat as local and trusted. When these URLs are returned as redirects, some browsers may follow them to third-party, untrusted sites. Although this vulnerability does not directly expose user credentials or tokens, it can be exploited as part of a phishing attack to steal user credentials. The affected methods include GetAuthorizationContextAsync, IsValidReturnUrl, GetIdentityServerRelativeUrl, ParseAsync, and IsValidReturnUrl.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0-preview.1, < 6.0.56.0.5 -
>= 6.1.0-preview.1, < 6.1.86.1.8 -
>= 6.2.0-preview.1, < 6.2.56.2.5 -
>= 6.3.0-preview.1, < 6.3.106.3.10 -
>= 7.0.0-preview.1, < 7.0.67.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, you can use the following code snippet as a workaround to validate return URLs in the user interface code:
// Example code to validate return URLs using IUrlHelper.IsLocalUrl
public IActionResult Login(string returnUrl)
{
if (Url.IsLocalUrl(returnUrl))
{
// Process the login request
// ...
return Redirect(returnUrl);
}
// Handle invalid return URL
// ...
}
This code snippet demonstrates how to use the IsLocalUrl method from the IUrlHelper interface to validate the return URL before redirecting the user.
Conclusion
The IdentityServer Open Redirect vulnerability in Duende.IdentityServer allows attackers to craft malicious URLs that can trick the system into redirecting users to untrusted sites. While it does not directly expose sensitive information, it can be exploited in phishing attacks to steal user credentials. Upgrading to the latest version of Duende.IdentityServer is the recommended solution, but if that is not feasible, using the provided workaround can help mitigate the risk.
See every vulnerability recorded for Duende.IdentityServer →
FAQ
The vulnerability allows attackers to craft malicious URLs that can trick IdentityServer into redirecting users to untrusted sites. While it does not directly expose user credentials or tokens, it can be exploited in phishing attacks to steal user credentials.
Versions 7.0.0-preview.1 to 7.0.5, 6.3.0-preview.1 to 6.3.9, 6.2.0-preview.1 to 6.2.4, 6.1.0-preview.1 to 6.1.7, and 6.0.0-preview.1 to 6.0.4 of Duende.IdentityServer are affected by this vulnerability.
Yes, if upgrading is not possible, you can use the IUrlHelper.IsLocalUrl method from ASP.NET Core 5.0 or later to validate return URLs in the user interface code of the IdentityServer host.
Yes, the vulnerability has been fixed in the following versions of Duende.IdentityServer: 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5.
Yes, all versions of IdentityServer4 are affected by this vulnerability. It is recommended to upgrade to the latest version of Duende.IdentityServer.
References
Related vulnerabilities
Recent vulnerabilities recorded for Duende.IdentityServer.
