Open Redirect in smart-sso OAuth2 Login Handler

Executive Summary

This vulnerability is an open redirect flaw in smart-sso through version 2.1.1. It allows unauthenticated attackers to steal OAuth2 authorization codes by exploiting an unvalidated redirectUri parameter in the /login handler. Attackers send crafted links to users with active SSO sessions, who are then redirected to an attacker-controlled URL with the authorization code appended. The server fails to validate if the redirectUri belongs to the intended application, enabling code theft.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious /login requests with unvalidated redirectUri parameters. Check server logs for unusual authorization code generation or redirection patterns. Inspect OAuth2 flow logs for codes being redeemed by unexpected applications. Use tools like Wireshark or tcpdump to capture HTTP requests to /login and /oauth2/access_token endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you use smart-sso for authentication, attackers could steal your OAuth2 authorization codes by tricking you into clicking a malicious link while you have an active SSO session. They can then redeem the stolen code using valid client credentials to obtain your access tokens, potentially gaining full account takeover at the SSO layer and access to any downstream applications that trust the SSO tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized data exposure, and non-compliance with access control and session management requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade smart-sso to a patched version beyond 2.1.1. If upgrading is not possible, disable the /login endpoint or restrict access to it. Validate all redirectUri parameters against a whitelist of trusted URIs. Rotate all OAuth2 client credentials and invalidate any default credentials. Monitor for unauthorized token redemption attempts.

Useful 0 Not Useful 0