GHSA-mx43-r985-5h4m

Suggest an improvement
Source
https://github.com/advisories/GHSA-mx43-r985-5h4m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-mx43-r985-5h4m/GHSA-mx43-r985-5h4m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mx43-r985-5h4m
Aliases
Published
2021-12-20T18:12:47Z
Modified
2023-11-08T04:02:09.885872Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Open redirect vulnerability in Sourcegraph
Details

Impact

An open redirect vulnerability that allows users to be targeted for phishing attacks has been found in Sourcegraph instances configured with OAuth, OpenID, or SAML authentication enabled. Users targeted by these phishing attacks could have their authentication tokens silently harvested by an attacker.

Specific Go Packages Affected

github.com/sourcegraph/sourcegraph/cmd/frontend/auth

Resolution

Sourcegraph v3.14.4 and v3.15.1 have been released which resolve the vulnerability. (associated change)

Workarounds

Disabling OAuth, OpenID and/or SAML sign-in options until upgraded to the patched versions will secure Sourcegraph / workaround the issue.

Timeline

  • Apr 23, 8 AM PST: GitHub Security Lab reported the issue to Sourcegraph.
  • Apr 23, 11 PM PST: A Sourcegraph engineer proposed a resolution for the vulnerability. https://github.com/sourcegraph/sourcegraph/pull/10167
  • Apr 24, 3 AM PST: The proposed resolution was reviewed, approved, and merged.
  • Apr 28, 2 PM PST: Patch releases for 3.14.4 and 3.15.1 were published.
  • Apr 29, 10 PM PST: Mitre publicly disclosed CVE-2020-12283.
  • Apr 30, 11 AM PST: Sourcegraph issued a GitHub security advisory and notified all affected users.

References

For more information

If you have any questions or comments about this advisory, please contact us at support@sourcegraph.com and include CVE-2020-12283 in the title.

References

Affected packages

Go / github.com/sourcegraph/sourcegraph

Package

Name
github.com/sourcegraph/sourcegraph
View open source insights on deps.dev
Purl
pkg:golang/github.com/sourcegraph/sourcegraph

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.14.4

Go / github.com/sourcegraph/sourcegraph

Package

Name
github.com/sourcegraph/sourcegraph
View open source insights on deps.dev
Purl
pkg:golang/github.com/sourcegraph/sourcegraph

Affected ranges

Type
SEMVER
Events
Introduced
3.15.0
Fixed
3.15.1