CVE-2020-15233 Medium · 6.1 EPSS 0.8%

OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

ory · fosite

Official description · CVE.org

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a redirect URL that is to the loopback adapter. Attackers can provide both custom URL query parameters to their loopback redirect URL, as well as actually overriding the host of the registered redirect URL. These attacks are only applicable in scenarios where the attacker has access over the loopback interface. This vulnerability has been patched in ORY Fosite v0.34.1.

Breakdown

15.6 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Send phishing linksT1566.002 · Spearphishing LinkSource data4 general detection rules
What can follow
- Disguise malicious files as legitimateT1036 · MasqueradingSource data40 general detection rules

Disclosed on 2 Oct 2020. No public exploit code or confirmed exploitation is recorded.

4 fixes in github.com/ory/fosite over 8 days. The latest fix listed for github.com/ory/fosite is 0.34.1.

Fixes in github.com/ory/fositeGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

0.31.0CVE-2020-1522224 Sep 2020
0.34.0CVE-2020-1522324 Sep 2020
0.34.1CVE-2020-152332 Oct 2020
0.34.1CVE-2020-152342 Oct 2020Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Spearphishing Link T1566.002

MITRE CTID mapping of the CVE · how it is exploited

Stealth

Masquerading T1036

MITRE CTID mapping of the CVE · follow-on activity

Detection

0 rules for this CVE · 44 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-15233 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Spearphishing LinkT1566.0024 general rules

Potential Malicious Usage of CloudTrail System Managerhightest
Suspicious Execution via macOS Script Editormediumtest
Suspicious Email Delivered In Microsoft 365mediumexperimental
EvilTokens PhaaS Kit Phishing Related Request - Proxylowexperimental

MasqueradingT103640 general rules

Potential LSASS Process Dump Via Procdumphighstable
CreateDump Process Dumphightest
Forfiles.EXE Child Process Masqueradinghightest
HackTool - XORDump Executionhightest
Password Protected ZIP File Opened (Suspicious Filenames)hightest
Potential SysInternals ProcDump Evasionhightest
Process Execution From A Potentially Suspicious Folderhightest
Process Memory Dump Via Comsvcs.DLLhightest

All 40 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/ory/fosite.

Gogithub.com/ory/fositeGHSA-rfq3-w54c-f9q5

Upgrade to 0.34.1 or later

Gogo get github.com/ory/fosite@v0.34.1

The first fix for CVE-2020-15233. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you run	Upgrade to
0.30.3 up to 0.34.1	0.34.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_MISC 1

github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf

x_refsource_CONFIRM 1

github.com/ory/fosite/security/advisories/GHSA-rfq3-w54c-f9q5

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2021-1179

No public exploit code found.

, 30 Oct 2026

0.8%Top 43%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 56.5%).

3.1

6.1Medium · 6.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.5653 11.3/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 6.1 4.3/7

End-of-life productsupported or unknown 0.0

Total15.6

Record

Published: 2 Oct 2020
Modified: 4 Aug 2024
: CWE-20 Improper Input ValidationCWE-601 URL Redirection to Untrusted Site
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.