OPAC Login Redirect To Will Redirect to External Sites

[Jason Stephenson]

Evergreen Versions: 3.2.10 and 3.6.1
OpenSRF Versions: N/A
PostgreSQL Version: N/A
Linux Distor: N/A

Similar to bug 1314827, the OPAC login redirect_to paramater can be modified to redirect to an external site if manually manipulated by the user or supplied as a URL.

For a proof of concept, try this on your OPAC installation

/eg/opac/login?redirect_to=https://www.google.com/

and see where you end up.

The redirect_to code should likely not follow external links, even when manually supplied by the user.

I'm not sure how exploitable this is, so I'm making this a private security bug pending research/a fix.

[Jason Stephenson (jstephenson)]

I'm removing milestones because I don't think I'll have a fix for this in time.

I also want there to be some discussion of whether or not this is actually a bug. To that end, I'll make this a public bug after the security releases on 1/27/21.

[Jason Stephenson (jstephenson)]

I'm starting to think that this may be a feature and not a bug, as a site could allow you to log in to the OPAC and then redirect you back, but I'm not sure what the utility of such a feature is.

[Jason Stephenson (jstephenson)]

This turned up in a PCI DSS audit of our site, so I'm inclined to say it's a bug. Does an external 3rd party finding it count for marking a bug confirmed?

[Jason Stephenson (jstephenson)]

I'm setting this to confirmed because it was picked up in a scan conducted by SecurityMetrics:

The web application accepts a parameter value that allows redirects to unrestricted locations.

The remote web application contains functionality to redirect to a specific URL. Thisfun ctionality is not restricted to relative URLs within the application and could be leveraged by an attacker to fool an end user into believing that a malicious URL they were redirected to is valid.

Parameters that are used to dynamically redirect must be restricted to paths within the application. If relative paths are accepted, the base path should be explicitly prepended.

The following parameters are vulnerable to open redirects : /eg/opac/temp_warn/postredirect_to

[Mike Rylander (mrylander)]

I've pushed a branch to the security repo at security/user/miker/lp-1908576-restrict-login-redirect that implements a domain-based redirect restriction. From the commit message:

This commit implements a new global flag: opac.login_redirect_domains

When this flag is enabled (default), redirection from login via redirect_to will be restricted to local URLs. For local URLs, they must either start with a / (provide an absolute path) or the hostname in the URL must match the current hostname and have a scheme of http, https, ftp, or ftps.

The value for the global flag can be set to a list of comma-separated domain names. Redirection to these domains, and subdomains/hosts thereof, will also be allowed. For all non-local URLs allowed by the global flag value, the scheme must be one of http, https, ftp, or ftps.

[Jason Stephenson (jstephenson)]

I have tested Mike's branch, and it works for me. I've pushed a signed off branch to security/user/dyrcona/lp-1908576-restrict-login-redirect-signoff.

Thanks, Mike!

[Jason Stephenson (jstephenson)]

Just adding that this branch needs a release note and the new global flag requires documentation.

[Mike Rylander (mrylander)]

I've pushed a rebased branch with release notes to: security/user/miker/lp-1908576-restrict-login-redirect-signoff-rebase