target_link_uri: how to prevent being used as an open redirector to external sites ?

[Meheni]

Hi,

we have been using the mode_auth-openidc module for a long time and are very fond of your work.

Recently we have forged a URL for a phishing attack that redirects the user, after their authentication on our OP, to any site of our choice.

the forged url is as follows:
https://<oidc_callback>?iss=<issuer>&target_link_uri=https://FQDN_phishing\.<domain_your_oidc_callback>/

example:
https://myapplication.local/app/redirect_oidc?iss=<issuer>&target_link_uri=https://google.fr\.myapplication.local

After authentication, user is redirect to https://google.fr\.myapplication.loca

According to the OpenID Connect documentation,
https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin

_

"target_link_uri
OPTIONAL. URL that the RP is requested to redirect to after authentication. RPs MUST verify the value of the target_link_uri to prevent being used as an open redirector to external sites."

_

Does the module verify the value of the target_link_uri to prevent being used as an open redirector to external sites? and how to configure it in the module?

Best regards,
Meheni

[zandbelt]

there is some work to prevent that, see https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.9.3/src/mod_auth_openidc.c#L2396-L2458, but I just realized that the OIDCRedirectURLsAllowed functionality introduced in 2.4.4 https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.9.3/auth_openidc.conf#L920-L928 should also be applied to the target_link_uri parameter, which was omitted so far; I'll create a fix and release for that soon, thanks for spotting this

[Meheni]

Hi,
Thank you for your work.

I'm looking forward for the fix

Meheni

[zandbelt]

which version of the module are you on?

[Meheni]

hi,

we are using version 2.4.4.1 but we will soon upgrade to the latest version 2.4.9.3.

Best regards,
Meheni

[Meheni]

Hi,

I just tested the new version 2.4.9.4 and the fixed works very well.

I have the following message on my browser :

Error:

URL not allowed

Description:

value does not match the list of allowed redirect URLs: https://google.fr/.myapplication.local

Thank you again for your work.
Best regards,
Meheni