Open redirect vulnerability when `prompt=none` about doorkeeper-openid_connect

[toupeira]

@meagar thanks again :)

I've prepared a PR in #66 to catch this, I would appreciate it if you could take a look!

Also, not sure if this is serious enough to warrant a CVE? Let me know if you have experience with that, otherwise I'll look into it.

I think the correct behaviour here is to render a 422 error, rather than redirect the browser, regardless of the prompt=none.

I'm not sure if the 422 error should have precedence, since we're already returning the OIDC/OAuth error. The code in #66 currently returns a 401.

[toupeira]

Released with version 1.5.4

[meagar]

Sorry, I've been away from the Internet for personal reasons.

I don't know if this warrants a CVE, but it'd be fun for me to create one. Would you be OK with that? I think it's wise to publicly disclose this problem, since it's a very real attack vector.

[toupeira]

@meagar thanks, but I was curious as well and requested one through iwantacve.org :) I got an automated reply a few weeks ago and just inquired again about the current state.

I also see now they have an official form online at https://cveform.mitre.org/, it used to redirect to a Google form so maybe that's why my request got lost.

[toupeira]

@meagar ok had to submit a new request and got a CVE assigned now, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9837

I credited you as the discoverer but looks like it's not displayed anywhere, sorry ;-)