CVE-2016-6636 UAA Open Redirect Vulnerability for Subdomains

Severity

Medium

Vendor

Cloud Foundry Foundation

Versions Affected

• Cloud Foundry release v241 and earlier versions
• UAA release v2.0.0 – v2.7.4.6, v3.0.0 – v3.4.2
• UAA BOSH release v12.3 & earlier versions

Description

Subdomains in the redirect_uri are not properly validated during OAuth authorization flow, making it possible to obtain implicit access tokens using a different subdomain in the request. Clients with the implicit authorization grant type are affected.

Mitigation

OSS users are strongly encouraged to follow one of the mitigations below:

• Upgrade to Cloud Foundry v242 [1] or later

For standalone UAA users:

• For users using UAA Version 3.0.0 – 3.4.2, please upgrade to UAA Release to v3.7.0[2], v3.4.4[3] or v3.3.0.5[4]
• For users using standalone UAA Version 2.X.X, please upgrade to UAA Release to v2.7.4.7 [5]
• For users using UAA bosh release, please upgrade to UAA-Release v16 [6] if upgrading to v3.7.0 [2] ,v12.5 [7] if upgrading to v3.4.4[3] or v11.5 [8] if upgrading to v3.3.0.5[4]

Credit

GE Digital Security Team

References

• [1] https://github.com/cloudfoundry/cf-release/releases/tag/v242
• [2] https://github.com/cloudfoundry/uaa/releases/tag/3.7.0
• [3] https://github.com/cloudfoundry/uaa/releases/tag/3.4.4
• [4] https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.5
• [5] https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.7
• [6] https://github.com/cloudfoundry/uaa-release/releases/tag/v16
• [7] https://github.com/cloudfoundry/uaa-release/releases/tag/v12.5
• [8] https://github.com/cloudfoundry/uaa-release/releases/tag/v11.5

History

2016-09-26: Initial vulnerability report published