URL Redirection to Untrusted Site ('Open Redirect')
CVE-2024-39694
Summary
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. An attacker can craft malicious URLs that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a URL is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This issue affects Duende.IdentityServer versions 6.0.0-preview.1 through 6.0.4, 6.1.0-preview.1 through 6.1.7, 6.2.0-preview.1 through 6.2.4, 6.3.0-preview.1 through 6.3.9, and 7.0.0-preview.1through 7.0.5.
- LOW
- NETWORK
- NONE
- CHANGED
- REQUIRED
- NONE
- LOW
- NONE
CWE-601 - Open Redirect
An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.
References
Advisory Timeline
- Published