Open Redirect Affecting github.com/pomerium/pomerium/config package, versions <0.13.4


Severity

Recommended
0.0
medium
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.2% (43rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMPOMERIUMPOMERIUMCONFIG-1090591
  • published4 Apr 2021
  • disclosed4 Apr 2021
  • creditcure53

Introduced: 4 Apr 2021

CVE-2021-29651  (opens in a new tab)
CWE-200  (opens in a new tab)
CWE-601  (opens in a new tab)

How to fix?

Upgrade github.com/pomerium/pomerium/config to version 0.13.4 or higher.

Overview

Affected versions of this package are vulnerable to Open Redirect. Using programmatic access on protected sites, an attacker can get a signed login URL with pomerium_redirect_uri set to an arbitrary URL, which allows redirecting a victim to the attacker’s site, and a JWT leakage.

References

CVSS Base Scores

version 3.1