Open Redirection Vulnerability in friendsofsymfony/oauth2-php
Summary
GHSA-xm3x-4ph3-3x9c: friendsofsymfony/oauth2-php open redirection in oauth. Affects friendsofsymfony/oauth2-php versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The friendsofsymfony/oauth2-php library is a package available on Packagist that provides OAuth 2.0 server and client functionality for Symfony applications. It allows developers to implement OAuth authentication in their applications. However, a vulnerability has been discovered in this library that could potentially expose users to unauthorized redirects during the OAuth authentication process.
Vulnerability Detail
The identified vulnerability in the friendsofsymfony/oauth2-php library is an open redirection vulnerability. This means that an attacker could manipulate the OAuth authentication flow to redirect users to malicious websites. By exploiting this vulnerability, an attacker could trick users into visiting a phishing site or a site hosting malware. The impact of this vulnerability could range from unauthorized data access to complete compromise of user accounts. The vulnerability has been addressed by implementing an exact check for the domain and port, ensuring more secure redirection.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
composer require friendsofsymfony/oauth2-php:1.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The open redirection vulnerability in the friendsofsymfony/oauth2-php library can expose users to unauthorized redirects during the OAuth authentication process. It is crucial for developers to update to version 1.3.0 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for friendsofsymfony/oauth2-php →
FAQ
An open redirection vulnerability is a security flaw that allows an attacker to redirect users to malicious websites. It occurs when an application redirects users to a URL specified in a parameter without proper validation.
An attacker can exploit this vulnerability by manipulating the OAuth authentication flow and redirecting users to a malicious website. This can be done by modifying the redirect URL parameter or intercepting and modifying the authentication request.
The potential consequences of this vulnerability include unauthorized data access, account compromise, and exposure to phishing or malware sites. An attacker could trick users into entering their credentials on a fake login page or infect their devices with malware.
Yes, the vulnerability has been fixed in version 1.3.0 of the friendsofsymfony/oauth2-php library. Developers are advised to update to this version or later to mitigate the risk of exploitation.
To update the friendsofsymfony/oauth2-php library, modify your composer.json file to require version 1.3.0 or later of the package. Then run the composer update command to fetch the latest version and update your dependencies.
