ghsa-3pgj-pg6c-r5p7
Vulnerability from github
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Impact
- Attacker providing malicious redirect uri can cause DoS to oauthlib's web application.
- Attacker can also leverage usage of
uri_validate
functions depending where it is used.
What kind of vulnerability is it? Who is impacted?
Oauthlib applications using OAuth2.0 provider support or use directly uri_validate
function.
Patches
Has the problem been patched? What versions should users upgrade to?
Issue fixed in 3.2.2 release.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
The redirect_uri
can be verified in web toolkit (i.e bottle-oauthlib
, django-oauth-toolkit
, ...) before oauthlib is called. A sample check if :
is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.
References
Attack Vector:
- Attacker providing malicious redirect uri:
https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232
- Vulnerable uri_validate
functions:
https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py
PoC
python
is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path")
Acknowledgement
Special thanks to Sebastian Chnelik - PyUp.io
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "oauthlib" }, "ranges": [ { "events": [ { "introduced": "3.1.1" }, { "fixed": "3.2.2" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-36087" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-601" ], "github_reviewed": true, "github_reviewed_at": "2022-09-16T21:02:52Z", "nvd_published_at": "2022-09-09T21:15:00Z", "severity": "MODERATE" }, "details": "### Impact\n- Attacker providing malicious redirect uri can cause DoS to oauthlib\u0027s web application.\n- Attacker can also leverage usage of `uri_validate` functions depending where it is used.\n\n_What kind of vulnerability is it? Who is impacted?_\n\nOauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nIssue fixed in 3.2.2 release.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.\n\n### References\nAttack Vector:\n- Attacker providing malicious redirect uri:\nhttps://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232\n- Vulnerable `uri_validate` functions:\nhttps://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py\n\n### PoC\n```python\nis_absolute_uri(\"http://[:::::::::::::::::::::::::::::::::::::::]/path\")\n```\n\n### Acknowledgement\nSpecial thanks to Sebastian Chnelik - PyUp.io", "id": "GHSA-3pgj-pg6c-r5p7", "modified": "2024-10-07T16:52:33Z", "published": "2022-09-16T21:02:52Z", "references": [ { "type": "WEB", "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36087" }, { "type": "WEB", "url": "https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd" }, { "type": "PACKAGE", "url": "https://github.com/oauthlib/oauthlib" }, { "type": "WEB", "url": "https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py" }, { "type": "WEB", "url": "https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232" }, { "type": "WEB", "url": "https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1" }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2022-269.yaml" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI" }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.