In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and token request is checked against an incorrect URI pattern ("[a-zA-Z][a-zA-Z0-9+.-]+:") before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
References
Link | Resource |
---|---|
https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143 | Exploit Third Party Advisory |
https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12 | Exploit Third Party Advisory |
https://github.com/oauthjs/node-oauth2-server/issues/637 | Issue Tracking Third Party Advisory |
https://tools.ietf.org/html/rfc3986#section-3 | Third Party Advisory |
https://tools.ietf.org/html/rfc6749#section-3.1.2 | Third Party Advisory |
Configurations
History
07 Sep 2022, 20:15
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-601 | |
CPE | cpe:2.3:a:oauth2-server_project:oauth2-server:*:*:*:*:*:node.js:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
First Time |
Oauth2-server Project
Oauth2-server Project oauth2-server |
|
References | (MISC) https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12 - Exploit, Third Party Advisory | |
References | (MISC) https://github.com/oauthjs/node-oauth2-server/issues/637 - Issue Tracking, Third Party Advisory | |
References | (MISC) https://tools.ietf.org/html/rfc6749#section-3.1.2 - Third Party Advisory | |
References | (MISC) https://github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143 - Exploit, Third Party Advisory | |
References | (MISC) https://tools.ietf.org/html/rfc3986#section-3 - Third Party Advisory |
29 Aug 2022, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-08-29 21:15
Updated : 2023-12-10 14:35
NVD link : CVE-2020-26938
Mitre link : CVE-2020-26938
CVE.ORG link : CVE-2020-26938
JSON object : View
Products Affected
oauth2-server_project
- oauth2-server
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')