CVE-2022-36087 – oauthlib

Package

Manager: pip
Name: oauthlib
Vulnerable Version: >=3.1.1 <3.2.2

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00337 pctl0.55854

Details

OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI ### Impact - Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. - Attacker can also leverage usage of `uri_validate` functions depending where it is used. _What kind of vulnerability is it? Who is impacted?_ Oauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Issue fixed in 3.2.2 release. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ The `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required. ### References Attack Vector: - Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 - Vulnerable `uri_validate` functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py ### PoC ```python is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") ``` ### Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

Metadata

Created: 2022-09-16T21:02:52Z
Modified: 2024-10-07T16:52:33Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-3pgj-pg6c-r5p7/GHSA-3pgj-pg6c-r5p7.json
CWE IDs: ["CWE-20", "CWE-601"]
Alternative ID: GHSA-3pgj-pg6c-r5p7
Finding: F156
Auto approve: 1