CVE-2022-24794: Open Redirect in express-openid-connect
First published: Thu Mar 31 2022(Updated: )
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Auth0 Express Openid Connect | <2.7.2 |
Remedy
https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-24794?
CVE-2022-24794 is classified as a high severity vulnerability due to the potential for open redirect attacks that could be exploited by malicious users.
How do I fix CVE-2022-24794?
To fix CVE-2022-24794, update the Auth0 Express OpenID Connect middleware to version 2.7.2 or later.
What type of vulnerability is CVE-2022-24794?
CVE-2022-24794 is an Open Redirect vulnerability affecting the requiresAuth middleware in the Auth0 Express OpenID Connect package.
Who is affected by CVE-2022-24794?
Users of the Auth0 Express OpenID Connect middleware version prior to 2.7.2 are affected by CVE-2022-24794.
What applications are impacted by CVE-2022-24794?
Web applications using the Auth0 Express OpenID Connect middleware with the requiresAuth implementation are impacted by CVE-2022-24794.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/auth0
- canonical/auth0 express openid connect