CVE-2022-36087

OAuthLib (Python) 3.1.1 to 3.2.1: Malicious Redirect URI DoS

• CVSS 6.5
• CWE-601
• Configuration Issues
• Remote

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.

CVE

CVE-2022-36087

CWE

CWE-601

CVSS base score

6.5

Published

2022-09-09

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Open Redirects

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update OAuthLib to version 3.2.1 or higher.

from oauthlib.oauth2 import WebApplicationServer

def vulnerable_uri_validate(redirect_uri):
    return redirect_uri

def process_redirect_uri(redirect_uri):
    try:
        validated_uri = vulnerable_uri_validate(redirect_uri)
        print(f"Redirect URI is valid: {validated_uri}")
    except Exception as e:
        print(f"Error: {e}")

redirect_uri = "https://example.com"
process_redirect_uri(redirect_uri)

from oauthlib.oauth2 import WebApplicationServer
from oauthlib.oauth2.rfc6749.errors import InvalidRequestError

def uri_validate(redirect_uri):
    if not redirect_uri.startswith("https://"):
        raise InvalidRequestError("Invalid redirect URI")

    allowed_domains = ["example.com", "another-example.com"]
    if not any(redirect_uri.startswith(f"https://{domain}") for domain in allowed_domains):
        raise InvalidRequestError("Redirect URI not allowed")

    return redirect_uri

try:
    redirect_uri = "https://example.com"
    uri_validate(redirect_uri)
except InvalidRequestError as e:
    print(e)

@misc{vaitp:cve202236087,
  title        = {{OAuthLib (Python) 3.1.1 to 3.2.1: Malicious Redirect URI DoS}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-36087},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-36087/}}
}