CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
10.7%
It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site.
Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials.
In the DefaultIdentityServerInteractionService
, the GetAuthorizationContextAsync
method may return non-null and the IsValidReturnUrl
method may return true for malicious Urls, indicating incorrectly that they can be safely redirected to.
UI code calling these two methods is the most commonly used code path that will expose the vulnerability. The default UI templates rely on this behavior in the Login, Challenge, Consent, and Account Creation pages. Customized user interface code might also rely on this behavior. The following uncommonly used APIs are also vulnerable:
The ServerUrlExtensions.GetIdentityServerRelativeUrl
, ReturnUrlParser.ParseAsync
and OidcReturnUrlParser.ParseAsync
methods may incorrectly return non-null, and the ReturnUrlParser.IsValidReturnUrl
and OidcReturnUrlParser.IsValidReturnUrl
methods may incorrectly return true for malicious Urls.
This vulnerability is fixed in the following versions of Duende.IdentityServer:
Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates.
If upgrading is not possible, use IUrlHelper.IsLocalUrl
from ASP.NET Core 5.0 or later to validate return Urls in user interface code in the IdentityServer host.
Vendor | Product | Version | CPE |
---|---|---|---|
identityserver4.admin_project | identityserver4.admin | * | cpe:2.3:a:identityserver4.admin_project:identityserver4.admin:*:*:*:*:*:*:*:* |
* | duende.identityserver | * | cpe:2.3:a:*:duende.identityserver:*:*:*:*:*:*:*:* |
github.com/advisories/GHSA-ff4q-64jc-gx98
github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6
github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e
github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1
github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011
github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a
github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98
github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366
nvd.nist.gov/vuln/detail/CVE-2024-39694
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
AI Score
Confidence
Low
EPSS
Percentile
10.7%