Description
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
a466350665 smart-sso
Default version status: unaffected
0 to ≤ 2.1.1affected
pkg:github/a466350665/smart-ssoReferences
- https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-open-redirect ↗
- https://github.com/a466350665/smart-sso/blob/2.1.1/smart-sso-server/src/main/java/com/smart/sso/server/controller/LoginController.java#L53-L63 ↗
- https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/LoginController.java#L50-L59 ↗
- https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/Oauth2Controller.java#L55-L84 ↗
- https://github.com/a466350665/smart-sso ↗
- https://www.vulncheck.com/advisories/smart-sso-through-2.1.1-oauth2-authorization-code-theft-via-unvalidated-redirecturi ↗