PT-2022-18140 · Unknown · Nopcommerce

Adeadfed · Published 2022-10-20 · Updated 2022-10-21 · CVE-2022-26954

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NopCommerce versions 4.10 through 4.50.1

Description The issue allows remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter. This parameter is processed by several functions, including the ChangePassword function, SignInCustomerAsync function, SuccessfulAuthentication method, or the NopRedirectResultExecutor class.

Recommendations For NopCommerce versions 4.10 through 4.50.1, consider disabling the returnUrl parameter in the affected functions until a patch is available. Restrict access to the ChangePassword function, SignInCustomerAsync function, SuccessfulAuthentication method, and the NopRedirectResultExecutor class to minimize the risk of exploitation. Avoid using the returnUrl parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-26954

Affected Products

Nopcommerce

References · 5

• 🔥 https://gist.github.com/adeadfed/baea45138b7eb29e09f6505d56b56413 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26954 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26954 · Vendor Advisory
• https://github.com/nopSolutions/nopCommerce/releases · Note
• https://t.me/cibsecurity/51865 · Telegram Post