CVE-2018-8899: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-22T05:29Z
Repository: https://github.com/IdentityServer/IdentityServer4
Language: Other
Files changed: src/Host/web.config, src/IdentityServer4/Endpoints/Results/AuthorizeResult.cs
Commit date: 2018-03-20 09:01:26 -0400
Commit message: encode redirect uri in authorize response

Diff: diff --git a/src/Host/web.config b/src/Host/web.config
index 5ec51028..62ff6ec9 100644
--- a/src/Host/web.config
+++ b/src/Host/web.config
@@ -1,7 +1,6 @@
 ﻿<?xml version="1.0" encoding="utf-8"?>
-
 <!--
 Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
 Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
 -->
 <configuration>
@@ -10,8 +9,8 @@ Licensed under the Apache License, Version 2.0. See LICENSE in the project root
   -->
   <system.webServer>
     <handlers>
       <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified" />
     </handlers>
-    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" />
+    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" startupTimeLimit="3600" requestTimeout="23:00:00" />
   </system.webServer>
 </configuration>
\ No newline at end of file
diff --git a/src/IdentityServer4/Endpoints/Results/AuthorizeResult.cs b/src/IdentityServer4/Endpoints/Results/AuthorizeResult.cs
index a2bf1f22..a585aae0 100644
--- a/src/IdentityServer4/Endpoints/Results/AuthorizeResult.cs
+++ b/src/IdentityServer4/Endpoints/Results/AuthorizeResult.cs
@@ -13,10 +13,11 @@ using System;
 using IdentityServer4.Services;
 using IdentityServer4.Configuration;
 using IdentityServer4.Stores;
 using IdentityServer4.ResponseHandling;
 using Microsoft.AspNetCore.Authentication;
+using System.Text.Encodings.Web;
 
 namespace IdentityServer4.Endpoints.Results
 {
     internal class AuthorizeResult : IEndpointResult
     {
@@ -173,11 +174,13 @@ namespace IdentityServer4.Endpoints.Results
 
         private string GetFormPostHtml()
         {
             var html = FormPostHtml;
 
-            html = html.Replace("{uri}", Response.Request.RedirectUri);
+            var url = Response.Request.RedirectUri;
+            url = HtmlEncoder.Default.Encode(url);
+            html = html.Replace("{uri}", url);
             html = html.Replace("{body}", Response.ToNameValueCollection().ToFormPost());
 
             return html;
         }
 

Vulnerable code: 
    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" />
            html = html.Replace("{uri}", Response.Request.RedirectUri);
Fixed code:     <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" startupTimeLimit="3600" requestTimeout="23:00:00" />
using System.Text.Encodings.Web;
            var url = Response.Request.RedirectUri;
            url = HtmlEncoder.Default.Encode(url);
            html = html.Replace("{uri}", url);