Open Redirect in spring-security-oauth2

Vulnerability

Spring Security OAuth versions 2.3 prior to 2.3.5, 2.2 prior to 2.2.4, 2.1 prior to 2.1.4, 2.0 prior to 2.0.17, and older unsupported versions are susceptible to an open redirector attack in the authorization endpoint when using the DefaultRedirectResolver. The vulnerability allows a malicious user to craft a request with the authorization code grant type and a manipulated redirect_uri parameter, causing the authorization server to redirect the resource owner's user-agent to a URI controlled by the attacker, leaking the authorization code in the process [1][2][4].

Exploitation

An attacker must be able to craft a request to the authorization endpoint of an OAuth Authorization Server that uses @EnableAuthorizationServer and employs the DefaultRedirectResolver implementation. The attacker supplies a forged redirect_uri parameter that the resolver accepts as valid, which then causes the server to redirect the user-agent to the attacker's URI along with the authorization code. No prior authentication or special network position is required beyond being able to induce a resource owner to visit the crafted link or having the ability to send the request to the endpoint [1][2][4].

Impact

Successful exploitation leaks the authorization code to an attacker-controlled location. With the stolen authorization code, the attacker may be able to obtain an access token and impersonate the resource owner, leading to unauthorized access to protected resources. The impact is information disclosure (the authorization code) and subsequent potential for account takeover or data access, depending on the OAuth flow and scope [1][2][4].

Mitigation

Applications should upgrade to fixed versions: 2.3.5, 2.2.4, 2.1.4, or 2.0.17, depending on the version in use. The project is no longer under active maintenance and has been replaced by Spring Security's built-in OAuth2 support and Spring Authorization Server [3]. As a workaround, applications can implement a custom RedirectResolver instead of the vulnerable DefaultRedirectResolver. Patches were released in February 2019 [1][2][4].