Unauthenticated Open Redirect in Authlib OAuth 2.0

Compliance Impact

The vulnerability in Authlib's OAuth 2.0 authorization endpoint allows an attacker to perform an open redirect to an arbitrary URL without authentication or client validation. This can enable phishing and credential theft by abusing the trusted authorization server domain as a redirector.

Such open redirect vulnerabilities can undermine security controls required by standards and regulations like GDPR and HIPAA, which mandate protection of user data and prevention of unauthorized access or data breaches.

By enabling phishing and credential theft, this vulnerability could lead to unauthorized disclosure or misuse of personal or sensitive information, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending requests to the OAuth 2.0 authorization endpoint with unsupported response_type values and attacker-controlled redirect_uri parameters, then observing if the server responds with a 302 redirect to the supplied redirect_uri without proper validation.

A simple detection method is to craft an HTTP request to the authorization endpoint similar to the following:

• curl -v 'https://<auth-server>/authorize?response_type=unsupported&client_id=any&redirect_uri=https://attacker.com'

If the server responds with a 302 redirect to https://attacker.com, it indicates the presence of the vulnerability.

Monitoring network traffic for unexpected 302 redirects from the authorization endpoint to untrusted domains can also help detect exploitation attempts.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Authlib Python library's OAuth 2.0 authorization endpoint prior to versions 1.6.10 and 1.7.1. When a request uses an unsupported response_type and includes an attacker-controlled redirect_uri, the endpoint can be exploited to perform an unauthenticated open redirect.

The issue occurs before the system performs client lookup or validates the redirect URI, meaning an attacker does not need a valid client registration, an authenticated user, or any prior state to exploit it.

By sending a single crafted request to the authorization endpoint, an attacker can cause the server to respond with a 302 redirect to an arbitrary URL controlled by the attacker.

This vulnerability was fixed in Authlib versions 1.6.10 and 1.7.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to redirect users to malicious websites without authentication or authorization.

Such open redirects can be used in phishing attacks, where users are tricked into visiting attacker-controlled sites that may steal credentials or deliver malware.

Because the redirect happens before any client validation, it can be exploited even if the attacker does not have a valid client registration or user session.

Overall, this can lead to loss of user trust, potential credential compromise, and damage to the reputation of the affected service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Authlib to version 1.6.10 or 1.7.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0