CVE-2024-39694 Duende IdentityServer Open Redirect vulnerability
Attackers can craft malicious URLs to redirect users to untrusted sites, facilitating phishing attacks against IdentityServer users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-39694?
CVE-2024-39694 is a medium-severity vulnerability in DuendeSoftware IdentityServer, published on 31 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host.
Weakness: CWE-601
Which versions are affected by CVE-2024-39694?
12 open source packages ship an affected version, including Duende.IdentityServer and IdentityServer4.
| Package | Affected | Fixed in |
|---|---|---|
Duende.IdentityServer NuGet | From 6.0.0-preview.1 | 6.0.5 |
Duende.IdentityServer NuGet | From 6.0.0-preview.1 | 6.0.5 |
Duende.IdentityServer NuGet | From 6.1.0-preview.1 | 6.1.8 |
Duende.IdentityServer NuGet | From 6.1.0-preview.1 | 6.1.8 |
Duende.IdentityServer NuGet | From 6.2.0-preview.1 | 6.2.5 |
Duende.IdentityServer NuGet | From 6.2.0-preview.1 | 6.2.5 |
6 more packages
Duende.IdentityServer NuGet | From 6.3.0-preview.1 | 6.3.10 |
Duende.IdentityServer NuGet | From 6.3.0-preview.1 | 6.3.10 |
Duende.IdentityServer NuGet | From 7.0.0-preview.1 | 7.0.6 |
Duende.IdentityServer NuGet | From 7.0.0-preview.1 | 7.0.6 |
IdentityServer4 NuGet | All versions to 4.1.2 | None |
IdentityServer4 NuGet | All versions to 4.1.2 | None |
How do I fix CVE-2024-39694?
Upgrade Duende.IdentityServer to a fixed version for your release line: 6.0.5, 6.1.8, 6.2.5 or 6.3.10.
Is CVE-2024-39694 being exploited?
There is no known exploitation of CVE-2024-39694 in the wild and no public exploit code.
Sources
Also known as GHSA-ff4q-64jc-gx98.