Nextcloud User OIDC has an open redirection when logging in with User OIDC

Vulnerability

The user_oidc app, an OpenID Connect user backend for Nextcloud, contains an open redirect vulnerability in versions prior to 6.1.0. The login function and the code function directly return a RedirectResponse with a user-supplied redirectUrl parameter without verifying that it points to a local path. A malicious user can craft a login link containing an absolute URL (e.g., https://evil.com) as the redirectUrl. Upon successful authentication, the victim is redirected to that external URL.[1][2][3]

Exploitation

To exploit this, the attacker must provide a victim with a specially crafted login link that includes an arbitrary absolute URL as the redirectUrl parameter. The victim must click the link and successfully authenticate with the OpenID Connect provider. No special network position or privileges are required beyond the ability to share a link. The attacker does not need to intercept the authentication flow; the redirect happens after a legitimate login. The fix introduced in PR #961 sanitizes the redirect URL by extracting only the path component via parse_url($redirectUrl, PHP_URL_PATH), preventing absolute URLs from being used.[1][2]

Impact

An attacker who successfully exploits this can redirect an authenticated user to any external site. This is a classic open redirect, which can be used for phishing or to undermine trust in the Nextcloud instance. The confidentiality, integrity, and availability of the Nextcloud data are not directly compromised, but the user may be tricked into divulging credentials or other sensitive information on the malicious site. The severity is rated as medium (CVSS 5.4) due to the requirement for user interaction and the potential for phishing.[3]

Mitigation

The vulnerability is fixed in user_oidc version 6.1.0, released on 2024-11-15. Users should upgrade to this version or later. The fix is implemented in commit c923428, which ensures that the redirect URL is sanitized to only use the path component, thus blocking any absolute URLs. No workaround is available for versions prior to 6.1.0. This issue is not known to be in CISA's KEV catalog.[1][2][3]