CVE-2020-12283: 
NixOS vulnerability analysis and mitigation

CVE-2020-12283 is a vulnerability discovered in Sourcegraph versions before 3.15.1, identified on April 23, 2020. The vulnerability exists in the authentication workflow due to improper validation in the SafeRedirectURL method within the cmd/frontend/auth/redirect.go file. This security flaw specifically affects the handling of URL substrings like //foo//example.com (GitHub Security Lab).

The vulnerability is classified as an open redirect vulnerability (CWE-601) with a CVSS v3.1 base score of 6.1 (Medium). The technical issue stems from the SafeRedirectURL method's reliance on url.Parse and u.Path for relative path extraction. While the method attempts to transform absolute URLs starting with // into / and URLs starting with /\ into /%5C, it fails to properly handle URL normalization. The url.Parse function does not normalize double slashes, allowing attackers to craft malicious URLs that bypass security checks (GitHub Security Lab).

The vulnerability's impact varies depending on the context but primarily enables phishing attacks by allowing attackers to abuse trust relationships between victims and the redirecting site. More critically, when used in conjunction with OAuth flows, attackers could potentially redirect users to malicious sites and steal OAuth tokens. This is particularly concerning as SafeRedirectURL is utilized in Sourcegraph's OAuth implementation (GitHub Security Lab).

The vulnerability can be exploited by crafting specific URLs that bypass the SafeRedirectURL validation. For example, an attacker can create a URL like //foo//example.com, which results in u.Path returning //example.com. When this URL is processed by the browser, it resolves to the absolute URL http://example.com, effectively bypassing the intended security controls (GitHub Security Lab).

The vulnerability was patched in Sourcegraph versions 3.14.4 and 3.15.1, released on April 28, 2020. Users are advised to upgrade to these or later versions to mitigate the risk. The fix was deployed through a security patch that addresses the URL validation issues in the SafeRedirectURL method (GitHub Security Lab).