CVE-2019-3778
Open Redirect in spring-security-oauth2
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Spring Security OAuth, en la versiones 2.3 anteriores a la 2.3.5, en las 2.2 anteriores a las 2.2.4, en las 2.1 anteriores a la 2.1.4 y en las 2.0 anteriores a la 2.0.17 (y versiones anteriores no soportadas) podría ser susceptible a un ataque de redireccionamiento capaz de divulgar un código de autorización. Un usuario o atacante malicioso puede manipular una petición al endpoint de autorización mediante el uso del tipo de concesión de autorización y la especificación de un URI de redireccionamiento manipulado mediante el parámetro "redirect_uri". Esto puede provocar que el servidor de autorización redirija al user-agent del propietario del recurso a un URI bajo en control del atacante con el código de autorización divulgado. Esta vulnerabilidad expone las aplicaciones que cumplen con todos los siguientes requisitos: actúa en el rol de un servidor de autorización (@EnableAuthorizationServer) y utiliza DefaultRedirectResolver en AuthorizationEndpoint. Esta vulnerabilidad no expone las aplicacionesplciaciones que: actúan en el rol de un servidor de autorización (@EnableAuthorizationServer) y utilizan una implementación RedirectResolver que no sea DefaultRedirectResolver en AuthorizationEndpoint, actúan solamente en el rol de un servidor de recursos (p.ej., @EnableResourceServer) y actúan en el rol de solamente un cliente (p.ej., @EnableOAuthClient).
Spring Security OAuth versions 2.3 prior to 2.3.6 suffer from open redirection vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-01-03 CVE Reserved
- 2019-03-07 CVE Published
- 2019-06-17 First Exploit
- 2024-08-23 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html | Third Party Advisory |
|
| http://www.securityfocus.com/bid/107153 | Third Party Advisory | |
| https://www.oracle.com/security-alerts/cpujan2021.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/47000 | 2019-06-17 | |
| https://github.com/BBB-man/CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection | 2019-10-14 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://pivotal.io/security/cve-2019-3778 | 2021-01-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Pivotal Software Search vendor "Pivotal Software" | Spring Security Oauth Search vendor "Pivotal Software" for product "Spring Security Oauth" | >= 2.0.0 < 2.0.17 Search vendor "Pivotal Software" for product "Spring Security Oauth" and version " >= 2.0.0 < 2.0.17" | - |
Affected
| ||||||
| Pivotal Software Search vendor "Pivotal Software" | Spring Security Oauth Search vendor "Pivotal Software" for product "Spring Security Oauth" | >= 2.1.0 < 2.1.4 Search vendor "Pivotal Software" for product "Spring Security Oauth" and version " >= 2.1.0 < 2.1.4" | - |
Affected
| ||||||
| Pivotal Software Search vendor "Pivotal Software" | Spring Security Oauth Search vendor "Pivotal Software" for product "Spring Security Oauth" | >= 2.2.0 < 2.2.4 Search vendor "Pivotal Software" for product "Spring Security Oauth" and version " >= 2.2.0 < 2.2.4" | - |
Affected
| ||||||
| Pivotal Software Search vendor "Pivotal Software" | Spring Security Oauth Search vendor "Pivotal Software" for product "Spring Security Oauth" | >= 2.3.0 < 2.3.5 Search vendor "Pivotal Software" for product "Spring Security Oauth" and version " >= 2.3.0 < 2.3.5" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Corporate Lending Search vendor "Oracle" for product "Banking Corporate Lending" | 14.1.0 Search vendor "Oracle" for product "Banking Corporate Lending" and version "14.1.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Corporate Lending Search vendor "Oracle" for product "Banking Corporate Lending" | 14.3.0 Search vendor "Oracle" for product "Banking Corporate Lending" and version "14.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Corporate Lending Search vendor "Oracle" for product "Banking Corporate Lending" | 14.4.0 Search vendor "Oracle" for product "Banking Corporate Lending" and version "14.4.0" | - |
Affected
| ||||||