CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
EPSS
Percentile
10.7%
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use IUrlHelper.IsLocalUrl
from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host.
[
{
"vendor": "DuendeSoftware",
"product": "IdentityServer",
"versions": [
{
"version": "< 6.0.5",
"status": "affected"
},
{
"version": ">= 6.1.0-preview.1, <= 6.1.7",
"status": "affected"
},
{
"version": ">= 6.2.0-preview.1, <= 6.2.4",
"status": "affected"
},
{
"version": ">= 6.3.0-preview.1, <= 6.3.9",
"status": "affected"
},
{
"version": ">= 7.0.0-preview.1, <= 7.0.5",
"status": "affected"
}
]
}
]
github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6
github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e
github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1
github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011
github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a
github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98