CVE-2020-5233: Open Redirect Vulnerability in oauth2-proxy
Summary
CVE-2020-5233: Open Redirect in OAuth2 Proxy. Affects oauth2-proxy versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Also tracked for
The same CVE-2020-5233 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oauth2-proxy is a package developed by Bitnami that provides a reverse proxy and authentication solution for securing web applications with OAuth2 providers. It allows users to authenticate with various OAuth2 providers and then proxies requests to backend services, providing authentication and authorization. This package is widely used in web applications to implement OAuth2 authentication.
Vulnerability Detail
OAuth2 Proxy before version 5.0 is affected by an open redirect vulnerability (CVE-2020-5233). This vulnerability allows an attacker to silently harvest authentication tokens. By exploiting this vulnerability, an attacker can trick users into visiting a malicious URL that redirects them to a legitimate OAuth2 provider's login page. Once the user enters their credentials, the attacker can intercept the authentication token and gain unauthorized access to the user's account. This vulnerability poses a significant risk to the security and privacy of users' accounts.
How To Fix
Minimum fixed version
5.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The open redirect vulnerability (CVE-2020-5233) in oauth2-proxy poses a significant risk to the security and privacy of user accounts. It allows attackers to harvest authentication tokens and potentially gain unauthorized access to user accounts. To mitigate this vulnerability, it is crucial to upgrade to version 5.0 or later of oauth2-proxy. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oauth2-proxy →
FAQ
This vulnerability allows an attacker to harvest authentication tokens, potentially leading to unauthorized access to user accounts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of oauth2-proxy to fix the issue.
There are no known public exploits for this vulnerability at the moment. However, it is important to patch your oauth2-proxy installation as soon as possible to mitigate the risk.
This vulnerability was discovered by the Bitnami security team during internal security testing.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauth2-proxy.
