GHSA-3pgj-pg6c-r5p7

Suggest an improvement
Source
https://github.com/advisories/GHSA-3pgj-pg6c-r5p7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-3pgj-pg6c-r5p7/GHSA-3pgj-pg6c-r5p7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3pgj-pg6c-r5p7
Aliases
Published
2022-09-16T21:02:52Z
Modified
2024-02-16T08:20:26.334445Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI
Details

Impact

  • Attacker providing malicious redirect uri can cause DoS to oauthlib's web application.
  • Attacker can also leverage usage of uri_validate functions depending where it is used.

What kind of vulnerability is it? Who is impacted?

Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function.

Patches

Has the problem been patched? What versions should users upgrade to?

Issue fixed in 3.2.2 release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.

References

Attack Vector: - Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/granttypes/base.py#L232 - Vulnerable uri_validate functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/urivalidate.py

PoC

is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path")

Acknowledgement

Special thanks to Sebastian Chnelik - PyUp.io

References

Affected packages

PyPI / oauthlib

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.1
Fixed
3.2.2

Affected versions

3.*

3.1.1
3.2.0
3.2.1