CVE-2021-3639 Open redirect in mod auth mellon

Medium 6.1 Published 22 Aug 2022 Updated 3 Aug 2024

Attackers can exploit unsanitized logout URLs to redirect users to malicious sites, facilitating phishing attacks against users of the mod_auth_mellon module.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-3639?

CVE-2021-3639 is a medium-severity vulnerability in mod_auth_mellon, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.

Weakness: CWE-601

Which versions are affected by CVE-2021-3639?

It affects 1 product.

Linux distribution packages (24)

`mod_auth_mellon` AlmaLinux:8	All versions	`0.14.0-12.el8.1`
`mod_auth_mellon-diagnostics` AlmaLinux:8	All versions	`0.14.0-12.el8.1`
`mod_auth_mellon` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-12.el8.1`
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-12.el8.1`
`mod_auth_mellon-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-12.el8.1`
`mod_auth_mellon-diagnostics` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-12.el8.1`
`mod_auth_mellon-diagnostics-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-12.el8.1`
`mod_auth_mellon` Rocky Linux:8	All versions	`0:0.14.0-12.el8.1`
`apache2-mod_auth_mellon` SUSE:Enterprise Storage 7	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Module for Server Applications 15 SP3	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Real Time 15 SP2	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Server 12 SP5	All versions	`0.16.0-8.6.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`0.16.0-8.6.1`
`apache2-mod_auth_mellon` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Manager Proxy 4.1	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Manager Retail Branch Server 4.1	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` SUSE:Manager Server 4.1	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` openSUSE:Leap 15.3	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` openSUSE:Leap 15.4	All versions	`0.17.0-150200.5.7.1`
`apache2-mod_auth_mellon` openSUSE:Tumbleweed	All versions	`0.19.0-1.1`

Products include Uninett Mod Auth Mellon.

How do I fix CVE-2021-3639?

Apply the vendor's patch.

Is CVE-2021-3639 being exploited?

There is no known exploitation of CVE-2021-3639 in the wild and no public exploit code.

CVE-2017-6807 Auth bypass in n/a Medium 6.1

Sources

Also known as ALSA-2022:1934, AZL-10651, AZL-36962, DEBIAN-CVE-2021-3639, GHSA-mhcv-7w89-jjj5, RHSA-2022:1934 and 6 more.