GHSA-55p7-v223-x366: IdentityServer4 IdentityServer Open Redirect Vulnerability Vulnerability
MODERATEGHSA-55p7-v223-x366 is a MODERATE (CVSS 4.7) identityserver open redirect vulnerability vulnerability (CWE-601: URL Redirection to Untrusted Site ('Open Redirect')) affecting IdentityServer4 libraries in the NuGet ecosystem. The issue involves identityserver open redirect vulnerability. Remediation is available in the latest vendor maintenance releases.
GHSA-55p7-v223-x366 at a Glance
Security Impact
CVSS: 4.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
How to Fix GHSA-55p7-v223-x366
To remediate this vulnerability, upgrade all affected IdentityServer4 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade IdentityServer4 to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for IdentityServer4How to Check if You Are Affected
To determine whether your application is affected by GHSA-55p7-v223-x366, inspect your project dependencies for IdentityServer4:
inspect dependencies for IdentityServer4Analyze the terminal output to locate any version of IdentityServer4 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-601: URL Redirection to Untrusted Site ('Open Redirect'), where the web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. In IdentityServer4, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-55p7-v223-x366 Affected IdentityServer4 Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
IdentityServer4
|
NuGet |
≤ 4.1.2
|
|
References
Frequently Asked Questions
What is GHSA-55p7-v223-x366?
Which IdentityServer4 versions are affected?
What version fixes GHSA-55p7-v223-x366?
Is IdentityServer4 affected?
What is the CVSS score of GHSA-55p7-v223-x366?
What CWE is associated with GHSA-55p7-v223-x366?
How can I check NuGet dependencies for GHSA-55p7-v223-x366?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-55p7-v223-x366",
"modified" : "2024-07-31T19:57:33Z",
"published" : "2024-07-31T19:57:33Z",
"aliases" : [ ],
"summary" : "IdentityServer Open Redirect vulnerability",
"details" : "### Impact\nIt is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site.\n\n### Affected Methods\n- In the `DefaultIdentityServerInteractionService`, the `GetAuthorizationContextAsync` method may return non-null and the `IsValidReturnUrl` method may return true for malicious Urls, indicating incorrectly that they can be safely redirected to.\n\n _UI code calling these two methods is the most commonly used code path that will expose the vulnerability. The default UI templates rely on this behavior in the Login, Challenge, and Consent pages. Customized user interface code might also rely on this behavior. The following uncommonly used APIs are also vulnerable:_\n\n- The `ServerUrlExtensions.GetIdentityServerRelativeUrl`, `ReturnUrlParser.ParseAsync` and `OidcReturnUrlParser.ParseAsync` methods may incorrectly return non-null, and the `ReturnUrlParser.IsValidReturnUrl` and `OidcReturnUrlParser.IsValidReturnUrl` methods may incorrectly return true for malicious Urls.\n\n### Patches\nIdentityServer4 is no longer supported and will not be receiving updates. Please consider updating to [Duende.IdentityServer](https://duendesoftware.com).\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "NuGet",
"name" : "IdentityServer4"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "4.1.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98"
}, {
"type" : "WEB",
"url" : "https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-39694"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/IdentityServer/IdentityServer4"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-601" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-07-31T19:57:33Z",
"nvd_published_at" : null
}
}