CVE-2022-24794
📋 TL;DR
This vulnerability in Express OpenID Connect middleware allows attackers to redirect users to malicious websites after authentication. It affects users who apply the 'requiresAuth' middleware to catch-all routes in Express web applications. The issue occurs because the middleware doesn't properly sanitize URLs before redirecting users after login.
💻 Affected Systems
- Express OpenID Connect
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect authenticated users to phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Attackers trick users into visiting crafted URLs that redirect them to malicious sites after login, enabling phishing attacks or credential harvesting.
If Mitigated
With proper URL validation and patching, redirects only go to trusted domains within the application's control.
🎯 Exploit Status
Exploitation requires user interaction (visiting a crafted URL) but doesn't require authentication. The vulnerability is simple to exploit once discovered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.2
Vendor Advisory: https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c
Restart Required: Yes
Instructions:
1. Update package.json to require 'express-openid-connect' version '^2.7.2'. 2. Run 'npm update express-openid-connect'. 3. Restart your Express application.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement application-level URL validation to ensure redirects only go to trusted domains
- Use route-specific middleware instead of catch-all routes for authentication
🔍 How to Verify
Check if Vulnerable:
Check if your Express application uses express-openid-connect version <2.7.2 and applies requiresAuth middleware to catch-all routes.Check Version:
npm list express-openid-connectVerify Fix Applied:
Verify the package.json shows express-openid-connect version >=2.7.2 and test that crafted URLs with double slashes don't redirect to external domains.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in authentication logs
- Requests containing double slashes followed by external domains
Network Indicators:
- HTTP 302 redirects to unexpected external domains after authentication
SIEM Query:
source="auth_logs" AND (url="*//*" AND redirect_domain NOT IN allowed_domains)🔗 References
- https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad
- https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c
- https://github.com/auth0/express-openid-connect/commit/0947b92164a2c5f661ebcc183d37e7f21de719ad
- https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7p99-3798-f85c
