URL Redirection to Untrusted Site ('Open Redirect') Affecting identityserver4 package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-IDENTITYSERVER4-7577153
- published 1 Aug 2024
- disclosed 31 Jul 2024
- credit Unknown
Introduced: 31 Jul 2024
CVE-2024-39694 Open this link in a new tabHow to fix?
There is no fixed version for IdentityServer4.
Overview
IdentityServer4 is an OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') through the commonly used GetAuthorizationContextAsync and IsValidReturnUrl methods which return non-null values and the IsValidReturnUrl method which could return true for malicious URLs.
In addition, this could be exploited through the uncommonly used ServerUrlExtensions.GetIdentityServerRelativeUrl, ReturnUrlParser.ParseAsync and OidcReturnUrlParser.ParseAsync methods that could incorrectly return non-null, and the ReturnUrlParser.IsValidReturnUrl and OidcReturnUrlParser.IsValidReturnUrl methods that could incorrectly return true for malicious URLs.
Workaround
Users who are unable to upgrade to the fixed version can use IUrlHelper.IsLocalUrl from ASP.NET Core 5.0 or later to validate return Urls in user interface code in the IdentityServer host.