CVE-2024-1440: WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint
(updated )
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.
By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
References
- github.com/advisories/GHSA-cp5v-2hmc-3vjx
- github.com/wso2/carbon-identity-framework
- github.com/wso2/carbon-identity-framework/commit/29ea34ada98649c4ae71aa92f1cbe87ce82164b9
- github.com/wso2/carbon-identity-framework/commit/7033924b6d53ff843529743b259f6c48f4e9c177
- github.com/wso2/carbon-identity-framework/pull/5580
- github.com/wso2/carbon-identity-framework/pull/5747
- nvd.nist.gov/vuln/detail/CVE-2024-1440
- security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3171
Code Behaviors & Features
Detect and mitigate CVE-2024-1440 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →