CVE-2021-39191: URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc
modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of modauthopenidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the targetlinkuri parameter. A patch in version 2.4.9.4 made it so that the OIDCRedirectURLsAllowed setting must be applied to the targetlinkuri parameter. There are no known workarounds aside from upgrading to a patched version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mod_auth_openidcto a version that resolves this vulnerability.Fixed in 2.4.9.4 - Configuration
Ensure OIDCRedirectURLsAllowed is enforced for the target_link_uri parameter (introduced/required behavior in v2.4.9.4 to prevent open redirect attacks).
mod_auth_openidc OIDCRedirectURLsAllowed = applied to target_link_uri parameter
Event History
Frequently Asked Questions
What is CVE-2021-39191?
CVE-2021-39191 is a vulnerability in mod_auth_openidc, allowing an attacker to bypass authentication and gain unauthorized access.
What is mod_auth_openidc?
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party.
What is the severity of CVE-2021-39191?
CVE-2021-39191 has a severity rating of 6.1 (medium).
How can an attacker exploit CVE-2021-39191?
An attacker can exploit CVE-2021-39191 to bypass authentication and gain unauthorized access to the system.
How can I fix CVE-2021-39191?
To fix CVE-2021-39191, users should update to mod_auth_openidc version 2.4.9.4 or later.