OAUTH2-CODE-INJECTION-001 security auth_error ai_generated true

OAuth2 authorization code can be injected by attacker via open redirector on client

ID: security/oauth2-authorization-code-injection-via-open-redirector

Also available as: JSON · Markdown · 中文
85%Fix Rate
88%Confidence
1Evidence
2024-03-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
OAuth 2.0 RFC 6749 active — — —
Spring Security OAuth2 2.5.x active — — —
Microsoft Identity Platform v2.0 active — — —

Root Cause

Client application allows open redirects that an attacker can use to inject a stolen authorization code into the redirect URI, bypassing the state parameter check if the state is predictable or reused.

generic

中文

客户端应用程序允许开放重定向，攻击者可以利用它将窃取的授权码注入到重定向URI中，如果状态参数可预测或重用，则绕过状态参数检查。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc6749#section-10.12

Workarounds

  1. 85% success Implement strict redirect_uri validation on the client side: match exactly the registered URI, no wildcards or partial matches. Example in Spring Security: `http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`. 
    Implement strict redirect_uri validation on the client side: match exactly the registered URI, no wildcards or partial matches. Example in Spring Security: `http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`.
  2. 80% success Ensure the state parameter is a cryptographically random, non-reusable value per authorization request. Example in Node.js: `const state = crypto.randomBytes(16).toString('hex');` and store it in session for verification. 
    Ensure the state parameter is a cryptographically random, non-reusable value per authorization request. Example in Node.js: `const state = crypto.randomBytes(16).toString('hex');` and store it in session for verification.
  3. 95% success Disable open redirect functionality on the client application entirely. Audit all redirect endpoints and remove or restrict them to allowed whitelist. 
    Disable open redirect functionality on the client application entirely. Audit all redirect endpoints and remove or restrict them to allowed whitelist.

中文步骤

  1. 在客户端实施严格的重定向URI验证：精确匹配已注册的URI，不允许通配符或部分匹配。Spring Security示例：`http.authorizeRequests().oauth2Login().authorizationEndpoint().authorizationRequestRepository(new HttpSessionOAuth2AuthorizationRequestRepository())`。
  2. 确保state参数是每个授权请求的加密随机且不可重用的值。Node.js示例：`const state = crypto.randomBytes(16).toString('hex');` 并将其存储在会话中供验证。
  3. 完全禁用客户端应用程序上的开放重定向功能。审计所有重定向端点，并将其删除或限制到允许的白名单中。

Dead Ends

Common approaches that don't work:

  1. 70% fail

    If the state is predictable (e.g., timestamp-based) or reused, an attacker can craft a valid redirect with a stolen code.

  2. 60% fail

    Wildcard patterns can be exploited to match attacker-controlled subdomains.

  3. 90% fail

    The client must validate the redirect_uri to prevent code injection via open redirectors.