Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/oauth2-proxy/oauth2-proxy
  4. ›
  5. CVE-2020-11053

CVE-2020-11053: URL Redirection to Untrusted Site ('Open Redirect')

December 20, 2021

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. However, by crafting a redirect URL with HTML encoded whitespace characters the validation could be bypassed and allow a redirect to any URL provided. This has been patched in 5.1.1.

References

  • github.com/advisories/GHSA-j7px-6hwj-hpjg
  • github.com/oauth2-proxy/oauth2-proxy/commit/0d5fa211df8ef2449347a56b22c779eb8d894c43
  • github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg
  • nvd.nist.gov/vuln/detail/CVE-2020-11053

Code Behaviors & Features

Detect and mitigate CVE-2020-11053 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 5.1.1

Fixed versions

  • 5.1.1

Solution

Upgrade to version 5.1.1 or above.

Impact 6.1 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Source file

go/github.com/oauth2-proxy/oauth2-proxy/CVE-2020-11053.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:02 +0000.