Skip to content

Post-auth URL redirection to untrusted site ('Open Redirect')

Moderate
sreya published GHSA-wcx9-ccpj-hx3c Oct 28, 2024

Package

gomod github.com/coder/coder/v2 (Go)

Affected versions

2.16.0
>= 2.15.0, < 2.15.3
>= 2.3.1, < 2.14.4

Patched versions

2.16.1
2.15.3
2.14.4

Description

Summary

An issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g. https://google.com.

Details

On the login page, Coder checks for the presence of a redirect query parameter. On successful login, the user would be redirected to the location of the parameter. Improper sanitization allows attackers to specify a URL outside of the Coder application to redirect users to.

Impact

Coder users could potentially be redirected to a untrusted website if tricked into clicking a URL crafted by the attacker. Coder authentication tokens are not leaked to the resulting website.

To check if your deployment is vulnerable, visit the following URL for your Coder deployment:

  • https://<coder url>/login?redirect=https%3A%2F%2Fcoder.com%2Fdocs

Patched Versions

This vulnerability is remedied in

  • v2.16.1
  • v2.15.3
  • v2.14.4

All versions prior to 2.3.1 are not affected.

Thanks

References

GHSA-wcx9-ccpj-hx3c
69c1d98

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVE ID

No known CVE

Weaknesses

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Learn more on MITRE.

Credits
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy