OAUTH2-003 security auth_error ai_generated true

OAuth2 redirect_uri open redirect allows attacker to intercept authorization code via unvalidated wildcard

ID: security/oauth2-redirect-uri-open-redirect

Also available as: JSON · Markdown · 中文
88%Fix Rate
85%Confidence
1Evidence
2024-03-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
OAuth 2.0 RFC 6749 active — — —
Spring Security OAuth2 5.8.0 active — — —
Keycloak 22.0.0 active — — —

Root Cause

The OAuth2 authorization server accepts a redirect_uri with a wildcard domain (e.g., *.example.com) that matches an attacker-controlled subdomain, enabling authorization code interception.

generic

中文

OAuth2 授权服务器接受带有通配符域名的 redirect_uri（例如 *.example.com），该通配符匹配攻击者控制的子域名，从而允许授权码拦截。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc6749#section-10.15

Workarounds

  1. 88% success Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")` 
    Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")`
  2. 85% success Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }` 
    Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }`
  3. 92% success Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match 
    Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match

中文步骤

  1. Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")`
  2. Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }`
  3. Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match

Dead Ends

Common approaches that don't work:

  1. 95% fail

    This completely bypasses security and allows any attacker to use any redirect URI

  2. 80% fail

    Regex still allows attacker-controlled subdomains; the wildcard itself is the vulnerability

  3. 90% fail

    Expanding wildcards increases attack surface and does not fix the core issue