Aether AI
3967ece625
fix(security): OC-25 — Validate OAuth state parameter to prevent CSRF attacks ( #16058 )
...
* fix(security): validate OAuth state parameter to prevent CSRF attacks (OC-25)
The parseOAuthCallbackInput() function in the Chutes OAuth flow had two
critical bugs that completely defeated CSRF state validation:
1. State extracted from callback URL was never compared against the
expected cryptographic nonce, allowing attacker-controlled state values
2. When URL parsing failed (bare authorization code input), the catch block
fabricated a matching state using expectedState, making the caller's
CSRF check always pass
## Attack Flow
1. Victim runs `openclaw login chutes --manual`
2. System generates cryptographic state: randomBytes(16).toString("hex")
3. Browser opens: https://api.chutes.ai/idp/authorize?state=abc123 ...
4. Attacker obtains their OWN OAuth authorization code (out of band)
5. Attacker tricks victim into pasting just "EVIL_CODE" (not full URL)
6. parseOAuthCallbackInput("EVIL_CODE", "abc123...") is called
7. new URL("EVIL_CODE") throws → catch block executes
8. catch returns { code: "EVIL_CODE", state: "abc123..." } ← FABRICATED
9. Caller checks: parsed.state !== state → "abc123..." !== "abc123..." → FALSE
10. CSRF check passes! System calls exchangeChutesCodeForTokens()
11. Attacker's code exchanged for access + refresh tokens
12. Victim's account linked to attacker's OAuth session
Fix:
- Add explicit state validation against expectedState before returning
- Remove state fabrication from catch block; always return error for
non-URL input
- Add comprehensive unit tests for state validation
Remediated by Aether AI Agent security analysis.
* fix(security): harden chutes manual oauth state check (#16058 ) (thanks @aether-ai-agent)
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-02-14 15:28:52 +01:00
..
2026-02-13 17:57:30 +00:00
2026-02-09 17:02:55 -08:00
2026-02-13 11:39:51 +00:00
2026-02-14 02:34:04 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 15:27:41 +01:00
2026-01-31 16:19:20 +09:00
2026-02-13 17:48:04 +01:00
2026-02-13 16:29:10 +01:00
2026-02-14 14:42:08 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-08 16:20:13 -05:00
2026-02-01 10:03:47 +09:00
2026-02-01 10:03:47 +09:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 15:42:05 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 15:48:37 +01:00
2026-02-13 16:49:28 +01:00
2026-02-13 16:49:28 +01:00
2026-02-13 20:03:01 +00:00
2026-02-13 19:08:37 +00:00
2026-02-13 19:19:15 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 19:19:15 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 19:08:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-08 04:53:31 -08:00
2026-02-08 23:59:43 -08:00
2026-01-14 05:39:59 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-14 00:45:45 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-14 15:28:52 +01:00
2026-02-14 15:28:52 +01:00
2026-02-13 14:28:22 +00:00
2026-01-11 11:45:25 +00:00
2026-02-05 12:09:23 -08:00
2026-02-13 16:20:37 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-06 13:16:58 -05:00
2026-01-31 16:19:20 +09:00
2026-02-04 04:10:13 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 00:46:56 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 20:04:53 +05:30
2026-01-31 16:19:20 +09:00
2026-02-10 18:58:45 -06:00
2026-01-31 16:19:20 +09:00
2026-02-05 16:54:44 -05:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-08 23:12:06 -08:00
2026-01-19 00:34:26 +00:00
2026-02-13 16:18:16 +01:00
2026-02-13 16:18:16 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-04 16:16:34 -05:00
2026-01-20 10:51:25 +00:00
2026-02-13 14:28:22 +00:00
2026-02-12 09:18:06 -05:00
2026-02-13 11:39:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-09 22:31:58 -06:00
2026-02-13 14:28:22 +00:00
2026-02-09 17:02:55 -08:00
2026-01-19 00:34:26 +00:00
2026-02-13 15:53:32 +00:00
2026-02-14 05:48:40 +01:00
2026-02-13 16:46:43 +00:00
2026-02-13 11:39:22 +00:00
2026-02-13 11:39:37 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-09 19:21:33 -08:00
2026-02-14 01:07:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 18:13:18 +01:00
2026-02-13 14:28:22 +00:00
2026-02-05 16:54:44 -05:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 16:20:37 +00:00
2026-02-13 14:44:36 -05:00
2026-02-14 05:48:40 +01:00
2026-02-14 01:20:42 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 05:48:40 +01:00
2026-02-13 15:48:37 +01:00
2026-02-13 15:53:32 +00:00
2026-02-11 10:51:59 -05:00
2026-02-13 15:53:32 +00:00
2026-02-14 12:23:51 +01:00
2026-02-14 01:20:42 +01:00
2026-02-14 01:20:42 +01:00
2026-02-13 20:26:39 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-14 13:27:45 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-02-05 19:55:02 -05:00
2026-02-13 11:39:37 +00:00
2026-02-13 11:39:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-02 01:22:41 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-12 18:23:27 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 18:18:57 -06:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 20:35:43 +01:00
2026-02-13 18:18:57 -06:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 16:21:59 +00:00
2026-02-13 16:20:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 18:18:57 -06:00
2026-02-13 14:28:22 +00:00
2026-02-12 18:14:14 -06:00
2026-02-07 20:02:32 -08:00
2026-02-14 02:50:35 +01:00
2026-02-12 18:48:11 -06:00
2026-02-12 18:48:11 -06:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-12 18:48:11 -06:00
2026-02-12 18:48:11 -06:00
2026-02-13 14:28:22 +00:00
2026-02-10 15:04:52 -05:00
2026-01-06 02:23:55 +01:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-01-30 03:16:21 +01:00
2026-02-14 02:50:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 02:50:35 +01:00
2026-02-14 02:34:04 +01:00
2026-02-13 18:13:18 +01:00
2026-02-14 02:50:35 +01:00
2026-02-14 02:50:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 15:42:05 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-14 02:34:04 +01:00
2026-02-02 16:18:09 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 19:57:02 +01:00
2026-02-13 14:28:22 +00:00
2026-01-17 08:06:35 +00:00
2026-02-13 14:28:22 +00:00
2026-02-08 23:59:43 -08:00
2026-02-13 16:20:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-04 19:11:23 -05:00
2026-02-13 16:04:49 +00:00
2026-02-13 15:58:08 +00:00
2026-01-14 15:02:19 +00:00
2026-02-13 14:28:22 +00:00
2026-02-02 23:56:27 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 02:02:01 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 17:32:14 +00:00
2026-02-13 02:02:01 +01:00
2026-02-13 14:28:22 +00:00
2026-02-05 16:08:46 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 17:32:14 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-07 09:32:31 -08:00
2026-02-14 14:42:08 +01:00
2026-02-14 14:42:08 +01:00
2026-02-13 14:28:22 +00:00
2026-02-09 13:27:21 -06:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 07:54:15 +00:00
2026-01-31 16:19:20 +09:00
2026-02-14 00:28:20 +00:00
2026-02-14 00:28:20 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-14 02:13:42 +01:00
2026-02-13 14:28:22 +00:00
2026-02-07 09:32:31 -08:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-12 15:27:56 -05:00
2026-02-13 14:28:22 +00:00
2026-02-07 20:02:32 -08:00
2026-02-10 08:49:34 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-02 17:36:49 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 01:57:49 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-04 19:49:36 -05:00
2026-01-31 16:19:20 +09:00
2026-02-13 16:46:43 +00:00
2026-02-13 11:39:51 +00:00
2026-02-13 11:39:51 +00:00
2026-02-13 14:28:22 +00:00
2026-02-12 23:52:19 -05:00
2026-02-14 02:23:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-06 13:16:58 -05:00
2026-02-13 14:28:22 +00:00
2026-02-09 18:56:58 -08:00
2026-02-13 16:04:49 +00:00
2026-02-14 06:33:14 -06:00
2026-02-14 00:45:45 +01:00
2026-02-14 06:33:14 -06:00
2026-02-12 07:01:48 -06:00