Open Redirect Vulnerability in pac4j-core Before 6.5.6

Executive Summary

A vulnerability in pac4j-core before 6.5.6 allows attackers to craft logout links that redirect victims to attacker-controlled sites after logout. This open redirect vulnerability has a CVSS score of 6.1 and is classified as medium severity. The vulnerability affects pac4j-core versions before 6.5.6.

Technical Analysis

The vulnerability is an open redirect vulnerability in the `DefaultLogoutLogic.perform()` method of pac4j-core. The method accepts backslash-prefixed logout redirect targets that match the `logoutUrlPattern`. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout. The root cause of the vulnerability is the lack of proper validation of the logout redirect targets.

How It Gets Exploited

An attacker can exploit this vulnerability by crafting a logout link with a backslash-prefixed external host that the browser will normalize into a network-path reference. For example, an attacker can craft a logout link with a URL like `\attacker-controlled-site.com` that the browser will normalize to `//attacker-controlled-site.com`, redirecting the victim to the attacker-controlled site after logout. The attacker does not need any privileges to exploit this vulnerability, but the victim must interact with the crafted logout link.

Impact Assessment

The vulnerability affects pac4j-core versions before 6.5.6. An attacker can use this vulnerability to redirect victims to attacker-controlled sites after logout, potentially leading to phishing attacks or other malicious activities. The CVSS score of 6.1 indicates a medium severity vulnerability.

Recommended Actions

To mitigate this vulnerability, update pac4j-core to version 6.5.6 or later. Additionally, implement proper validation of logout redirect targets to prevent open redirect vulnerabilities. Use a web application firewall (WAF) to detect and prevent suspicious logout link activity.

Sources

- National Vulnerability Database (NVD) - Vulncheck