Headline
CVE-2022-24794: Merge pull request from GHSA-7p99-3798-f85c · auth0/express-openid-connect@0947b92
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to http://example.com//google.com will be redirected to google.com after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
@@ -354,4 +354,21 @@ describe('requiresAuth’, () => {
assert.equal(response.statusCode, 401);
sinon.assert.notCalled(checkSpy);
});
it('should collapse leading slashes on returnTo’, async () => {
server = await createServer(auth(defaultConfig));
const payloads = ['//google.com’, '///google.com’, ‘//google.com’];
for (const payload of payloads) {
const response = await request({ url: `${baseUrl}${payload}` });
const state = new URL(response.headers.location).searchParams.get(
‘state’
);
const decoded = Buffer.from(state, ‘base64’);
const parsed = JSON.parse(decoded);
assert.equal(response.statusCode, 302);
assert.include(response.headers.location, ‘https://op.example.com’);
assert.equal(parsed.returnTo, ‘/google.com’);
}
});
});