Executive brief
OAuthlib is a Python library that implements the OAuth 2.0 authentication standard, widely used by web applications to handle user login and authorization flows. A flaw in its URI validation logic allows an attacker to send a specially crafted redirect URI containing malicious IPv6 formatting that causes the server to hang or crash, disrupting service availability for legitimate users.
Technical details
The vulnerability is an input validation flaw (CWE-20) in oauthlib's is_absolute_uri() validation function used to check redirect URIs during OAuth 2.0 provider flows. When an attacker provides a malicious redirect URI with excessive colons formatted as an IPv6 address (e.g., http://[:::::::::::::::::::::::::::::::::::::::]/path), the URI parsing logic enters an infinite loop or consumes excessive CPU/memory, causing a denial of service. The flaw affects applications using OAuth2.0 provider support or directly calling the uri_validate functions. The vulnerability requires low privileges and user interaction (redirect action) but is network-reachable. The issue was fixed in oauthlib version 3.2.2.
Affected products
- oauthlib oauthlib 3.1.1 to 3.2.1
Timeline
- 2022-09-09: disclosed: Vulnerability disclosed on NVD
- 2022-09-16: advisory: GitHub security advisory GHSA-3pgj-pg6c-r5p7 published
- 2022-09-16: patched: Fix released in oauthlib 3.2.2