LaChatterie Verger Deserialization Vulnerability in OAuth Provider

A deserialization vulnerability has been identified in LaChatterie Verger versions through 1.2.10. The issue arises in the 'redirectToAuthorization' function within '/src/main/services/mcp/oauth/provider.ts', where the 'URL' argument is manipulated, allowing for remote exploitation. This vulnerability has been publicly disclosed and is associated with authentication bypass, leading to arbitrary OS command injection on the client's host machine.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

The vulnerability can be reproduced by manipulating the 'URL' argument in the 'redirectToAuthorization' function. This can be done by embedding a payload in the URL's authentication field, which is then passed to an insecure open function, bypassing validation and executing arbitrary commands on the host machine.