CVE-2020-4037: oauth2-proxy Open Redirect Vulnerability
Summary
CVE-2020-4037: Open Redirect in OAuth2 Proxy. Affects oauth2-proxy versions >= 5.1.1, < 6.0.0. Fixed in 6.0.0. How to fix ↓
Also tracked for
The same CVE-2020-4037 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oauth2-proxy is an open-source reverse proxy and authentication server that provides authentication and authorization for web applications. It allows users to authenticate against various providers (e.g., Google, GitHub) and proxy requests to backend services. This vulnerability affects versions prior to 6.0.0 of oauth2-proxy.
Vulnerability Detail
The oauth2-proxy allows users to specify a redirect address for the proxy to send the authenticated user to after the authentication flow. This redirect URL is checked within the proxy to prevent malicious actors from providing redirects to potentially harmful sites. However, versions prior to 6.0.0 do not properly validate the redirect URL, leading to an open redirect vulnerability. An attacker could exploit this vulnerability by providing a crafted redirect URL, potentially tricking users into visiting malicious websites.
How To Fix
Minimum fixed version
6.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of oauth2-proxy.
Conclusion
The oauth2-proxy package prior to version 6.0.0 is vulnerable to an open redirect attack. Users should upgrade to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for oauth2-proxy →
FAQ
oauth2-proxy is a reverse proxy and authentication server that provides authentication and authorization for web applications.
An open redirect vulnerability occurs when a web application allows users to specify a redirect URL, but fails to properly validate it. This can be exploited by attackers to redirect users to malicious websites.
This vulnerability could allow an attacker to trick users into visiting malicious websites by providing a crafted redirect URL.
To fix this vulnerability, upgrade to version 6.0.0 or later of oauth2-proxy.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of oauth2-proxy.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauth2-proxy.
