Skip to main content

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2024-39694

Severity Medium
Score 4.7/10

Summary

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. An attacker can craft malicious URLs that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a URL is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This issue affects Duende.IdentityServer versions 6.0.0-preview.1 through 6.0.4, 6.1.0-preview.1 through 6.1.7, 6.2.0-preview.1 through 6.2.4, 6.3.0-preview.1 through 6.3.9, and 7.0.0-preview.1through 7.0.5.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-601 - Open Redirect

An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.

Advisory Timeline

  • Published