The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted

2023-12-2118:25:30

Google

osv.dev

redirect_uri

validation logic

bypass

allowed hosts

keycloak

browsers

desynchronization

user-controllable input

authority

url decoded

original input

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

Confidence

Low

EPSS

0.001

Percentile

46.2%

JSON

An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.

The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives “www%2ekeycloak%2eorg%2fapp%2f:[email protected]” and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.