CVE-2020-5409 Concourse Open Redirect in the /sky/login endpoint

What is CVE-2020-5409?

CVE-2020-5409 is a high-severity vulnerability in Pivotal Concourse, published on 13 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)

Weakness: CWE-601

Which versions are affected by CVE-2020-5409?

1 open source package ship an affected version, including concourse. It affects 1 product.

Products include Pivotal Software Concourse.

How do I fix CVE-2020-5409?

Upgrade concourse to a fixed version for your release line: 5.2.8, 5.5.10 or 5.8.1.

Is CVE-2020-5409 being exploited?

There is no known exploitation of CVE-2020-5409 in the wild and no public exploit code.

Other vulnerabilities in Pivotal Concourse

• CVE-2020-5415 Concourse's GitLab auth allows impersonation Critical 10.0
• CVE-2018-15798 Pivotal Concourse allows malicious redirect urls on login High 7.6
• CVE-2018-1227 Supply chain in Concourse CI: As of 2018-03-13, Pivotal does not believe that any resources or builds of Concourse have been compromised. High 7.5
• CVE-2019-3792 Concourse 5.0.0 SQL Injection vulnerability Medium 6.8
• CVE-2022-31683 Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution Medium 5.4

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as BIT-concourse-2020-5409.