CVE-2019-9837 Doorkeeper-openid_connect contains Open Redirect
An open redirect in the Doorkeeper OpenID Connect extension allows attackers to redirect users to malicious sites during OAuth authorization errors, facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-9837?
CVE-2019-9837 is a medium-severity vulnerability in n/a, published on 15 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Weakness: CWE-601
Which versions are affected by CVE-2019-9837?
2 open source packages ship an affected version, including doorkeeper-openid_connect. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
doorkeeper-openid_connect RubyGems | From 1.4.0 | 1.5.4 |
doorkeeper-openid_connect RubyGems | From 1.4.0 | 1.5.4 |
Products include Openid Openid Connect.
How do I fix CVE-2019-9837?
Upgrade doorkeeper-openid_connect to 1.5.4 or later.
Is CVE-2019-9837 being exploited?
There is no known exploitation of CVE-2019-9837 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-9837, GHSA-vv4c-g6q7-p3q7.