security config_error ai_generated true

OAuth2 redirect_uri验证允许路径遍历或子域名混淆

OAuth2 redirect_uri validation allows path traversal or subdomain confusion

ID: security/oauth2-redirect-uri-validation-weak

其他格式: JSON · Markdown 中文 · English
90%修复率
86%置信度
1证据数
2024-05-22首次发现

版本兼容性

版本状态引入弃用备注
Spring Authorization Server 1.1 active — — —
Keycloak 22.0 active — — —
Ory Hydra 2.2 active — — —

根因分析

OAuth2服务器通过检查redirect_uri是否以注册URI字符串开头来验证，而不是执行精确或严格前缀匹配，允许攻击者注册一个通过验证的恶意重定向URI。

English

The OAuth2 server validates the redirect_uri by checking if it starts with the registered URI string instead of performing exact or strict prefix matching, allowing an attacker to register a malicious redirect URI that passes validation.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2

解决方案

  1. 对redirect_uri与注册值实现精确字符串匹配。在Spring Security中，使用自定义RedirectUriValidator比较完整URI字符串。
  2. 使用包含路径和查询的严格前缀匹配，而不仅仅是主机。例如，在Node.js中：if (redirectUri !== registeredUri) { reject(); }
  3. 在验证前标准化redirect_uri，去除尾部斜杠、默认端口，并对方案和主机进行大小写折叠。

无效尝试

常见但无效的做法:

  1. 50% 失败

    Simply adding more registered URIs to the allowlist doesn't fix the validation logic flaw; attackers can still craft URIs that pass the flawed check.

  2. 60% 失败

    Blocking specific known malicious URIs is a reactive approach and cannot cover all possible bypasses.

  3. 80% 失败

    Turning off redirect_uri validation entirely is dangerous and allows open redirect attacks.