OAUTH2-003 security auth_error ai_generated true

OAuth2 redirect_uri 开放重定向允许攻击者通过未验证的通配符拦截授权码

OAuth2 redirect_uri open redirect allows attacker to intercept authorization code via unvalidated wildcard

ID: security/oauth2-redirect-uri-open-redirect

其他格式: JSON · Markdown 中文 · English
88%修复率
85%置信度
1证据数
2024-03-15首次发现

版本兼容性

版本状态引入弃用备注
OAuth 2.0 RFC 6749 active — — —
Spring Security OAuth2 5.8.0 active — — —
Keycloak 22.0.0 active — — —

根因分析

OAuth2 授权服务器接受带有通配符域名的 redirect_uri（例如 *.example.com），该通配符匹配攻击者控制的子域名，从而允许授权码拦截。

English

The OAuth2 authorization server accepts a redirect_uri with a wildcard domain (e.g., *.example.com) that matches an attacker-controlled subdomain, enabling authorization code interception.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc6749#section-10.15

解决方案

  1. Replace wildcard redirect_uri with an exact match list. Example in Spring Security: `clientRegistration.redirectUri("https://app.example.com/callback")`
  2. Implement a strict URI validation that rejects any URI containing a wildcard or asterisk character. Add a check: `if (redirectUri.contains("*")) { throw new InvalidRedirectUriException(); }`
  3. Use a whitelist of exact redirect URIs with no wildcards; validate using string equality or exact prefix match

无效尝试

常见但无效的做法:

  1. 95% 失败

    This completely bypasses security and allows any attacker to use any redirect URI

  2. 80% 失败

    Regex still allows attacker-controlled subdomains; the wildcard itself is the vulnerability

  3. 90% 失败

    Expanding wildcards increases attack surface and does not fix the core issue