PT-2022-17191 · Gophish · Gophish

Published 2022-09-11 · Updated 2024-08-21 · CVE-2022-25295

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions gophish versions prior to 0.12.0

Description The issue exists in the next query parameter, where the application uses url.Parse(r.FormValue("next")) to extract the path and redirect the user to a relative URL. However, if the next parameter starts with multiple backslashes, the browser will redirect the user to an absolute URL, such as http://example.com. This allows for an Open Redirect attack.

Recommendations For versions prior to 0.12.0, update to version 0.12.0 or later to resolve the issue. As a temporary workaround, consider validating the next parameter to prevent redirects to absolute URLs. Restrict access to the next query parameter to minimize the risk of exploitation. Avoid using the next parameter with multiple backslashes until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-25295

GHSA-HVW3-P9PX-GPC9

GO-2022-0987

Affected Products

Gophish

References · 11

• 🔥 https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOPHISHGOPHISH-2404177 · Exploit
• https://github.com/gophish/gophish/pull/2262 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25295 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25295 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0987 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hvw3-p9px-gpc9 · Vendor Advisory
• https://github.com/gophish/gophish · Note
• https://github.com/gophish/gophish/commit/2a452bda89ffdb85f929fa78290bce1f456881dc · Note
• https://github.com/gophish/gophish/releases/tag/v0.12.0 · Note
• https://t.me/cvenotify/35986 · Telegram Post
• https://github.com/advisories/GHSA-hvw3-p9px-gpc9 · Note