gsd-2021-21291
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for ".example.com", the intention is that subdomains of example.com are allowed. Instead, "example.com" and "badexample.com" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-21291",
"description": "OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for \".example.com\", the intention is that subdomains of example.com are allowed. Instead, \"example.com\" and \"badexample.com\" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.",
"id": "GSD-2021-21291"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-21291"
],
"details": "OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for \".example.com\", the intention is that subdomains of example.com are allowed. Instead, \"example.com\" and \"badexample.com\" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.",
"id": "GSD-2021-21291",
"modified": "2023-12-13T01:23:11.031534Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21291",
"STATE": "PUBLIC",
"TITLE": "Subdomain checking of whitelisted domains could allow unintended redirects"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "oauth2-proxy",
"version": {
"version_data": [
{
"version_value": "\u003c 7.0.0"
}
]
}
}
]
},
"vendor_name": "oauth2-proxy"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for \".example.com\", the intention is that subdomains of example.com are allowed. Instead, \"example.com\" and \"badexample.com\" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2",
"refsource": "CONFIRM",
"url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2"
},
{
"name": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0",
"refsource": "MISC",
"url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0"
},
{
"name": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7",
"refsource": "MISC",
"url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"
},
{
"name": "https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725",
"refsource": "MISC",
"url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725"
}
]
},
"source": {
"advisory": "GHSA-4mf2-f3wh-gvf2",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c=3.2.0",
"affected_versions": "All versions up to 3.2.0",
"cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-601",
"CWE-937"
],
"date": "2021-05-25",
"description": "OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the allowlist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a allowlist domain was configured for \".example.com\", the intention is that subdomains of example.com are allowed. Instead, \"example.com\" and \"badexample.com\" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the allowlist domain feature and run separate OAuth2 Proxy instances for each subdomain.",
"fixed_versions": [],
"identifier": "CVE-2021-21291",
"identifiers": [
"GHSA-4mf2-f3wh-gvf2",
"CVE-2021-21291"
],
"not_impacted": "",
"package_slug": "go/github.com/oauth2-proxy/oauth2-proxy",
"pubdate": "2021-05-25",
"solution": "Unfortunately, there is no solution available yet.",
"title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"urls": [
"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2",
"https://nvd.nist.gov/vuln/detail/CVE-2021-21291",
"https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725",
"https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0",
"https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7",
"https://github.com/advisories/GHSA-4mf2-f3wh-gvf2"
],
"uuid": "a24e667c-29bb-48d8-9c2b-86636d3e4e04"
},
{
"affected_range": "\u003c7.0.0",
"affected_versions": "All versions before 7.0.0",
"cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-601",
"CWE-937"
],
"date": "2021-05-25",
"description": "OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the allowlist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a allowlist domain was configured for \".example.com\", the intention is that subdomains of example.com are allowed. Instead, \"example.com\" and \"badexample.com\" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the allowlist domain feature and run separate OAuth2 Proxy instances for each subdomain.",
"fixed_versions": [
"7.0.0"
],
"identifier": "CVE-2021-21291",
"identifiers": [
"GHSA-4mf2-f3wh-gvf2",
"CVE-2021-21291"
],
"not_impacted": "All versions starting from 7.0.0",
"package_slug": "go/github.com/oauth2-proxy/oauth2-proxy/v7",
"pubdate": "2021-05-25",
"solution": "Upgrade to version 7.0.0 or above.",
"title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"urls": [
"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2",
"https://nvd.nist.gov/vuln/detail/CVE-2021-21291",
"https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725",
"https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0",
"https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7",
"https://github.com/advisories/GHSA-4mf2-f3wh-gvf2"
],
"uuid": "4ec255af-7854-4094-90fa-d5f970e63088"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "7.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21291"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect. For example, if a whitelist domain was configured for \".example.com\", the intention is that subdomains of example.com are allowed. Instead, \"example.com\" and \"badexample.com\" could also match. This is fixed in version 7.0.0 onwards. As a workaround, one can disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7",
"refsource": "MISC",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://pkg.go.dev/github.com/oauth2-proxy/oauth2-proxy/v7"
},
{
"name": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2"
},
{
"name": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0"
},
{
"name": "https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/780ae4f3c99b579cb2ea9845121caebb6192f725"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
},
"lastModifiedDate": "2021-02-08T16:36Z",
"publishedDate": "2021-02-02T19:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…