Closed ahpaleus closed 1 month ago
Added trust logout redirect uri
directive that validates the redirect URL. For example, trust logout redirect uri domain authcrunch.com path /foo/bar
.
That, in turn, enables the verification of the redirect url.
./pkg/authn/handle_external_http_logout.go: if redirects.HasRedirectURI(r.URL) && (len(p.config.TrustedLogoutRedirectURIConfigs) > 0) {
./pkg/authn/handle_external_http_logout.go: if redirects.Match(redirectURI, p.config.TrustedLogoutRedirectURIConfigs) {
./pkg/authn/portal.go: if len(p.config.TrustedLogoutRedirectURIConfigs) > 0 {
./pkg/authn/portal.go: zap.Any("trusted_logout_redirect_uri_configs", p.config.TrustedLogoutRedirectURIConfigs),
./pkg/authn/handle_http_logout.go: if redirects.HasRedirectURI(r.URL) && (len(p.config.TrustedLogoutRedirectURIConfigs) > 0) {
./pkg/authn/handle_http_logout.go: if redirects.Match(redirectURI, p.config.TrustedLogoutRedirectURIConfigs) {
@greenpau I tried adding trust logout redirect uri domain myhost path /
to my authentication portal
, but https://myhost/auth?redirect_url=https%3A%2F%2Fmalicoushost.com%2F
still redirects to the other host. Am I doing something wrong?
@binarious, thank you for testing the directive. please reach out to me on Linkedin. Will troubleshoot over Google Meet. Also, please open another issue for this and reference this one.
When a logged-in user clicks on a specially crafted link with a
redirect_url
parameter, the user can be redirected to an external website. The user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection. This could lead to phishing attacks, where an attacker tricks users into visiting a malicious website by crafting a convincing URL.When logged-in, a victim clicks on the link: https://portal.caddysecurity.network/auth/whoami?redirect_url=https://nvmgpc54pak47d02e6a1l6c6wx2oqfo3d.oastify.com
Then, he clicks on the
Portal
button. He is redirected to the redirect_url through this request:When he uses arrows in the browser to come back to the authorization process, he can be redirected to the external domain by this request too:
To mitigate this vulnerability, perform proper redirect_url parameter validation to ensure that the redirection URLs are allowed only within the same domain or from trusted sources.
In addition, we also recommend the following long-term fixes:
More information about our Caddy Security public disclosure: