CVE-2024-53264

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

No CVSS.

References

Link	Resource
https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q9rr-h3hx-m87g

Configurations

No configuration.

History

No history.

Information

Published : 2024-11-27 19:15

Updated : 2024-11-27 19:15

NVD link : CVE-2024-53264

Mitre link : CVE-2024-53264

CVE.ORG link : CVE-2024-53264

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2024-53264", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 5.1, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "LOW", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-11-27T19:15:33.400", "references": [{"url": "https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q9rr-h3hx-m87g", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the \"next\" parameter. The loading endpoint accepts and uses an unvalidated \"next\" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "bunkerweb es un firewall de aplicaciones web (WAF) de \u00faltima generaci\u00f3n y de c\u00f3digo abierto. Existe una vulnerabilidad de redirecci\u00f3n abierta en el endpoint de carga, que permite a los atacantes redirigir a los usuarios autenticados a URL externas arbitrarias a trav\u00e9s del par\u00e1metro \"next\". El endpoint de carga acepta y utiliza un par\u00e1metro \"next\" no validado para las redirecciones. Por ejemplo, visitar: `/loading?next=https://google.com` mientras est\u00e1 autenticado har\u00e1 que la p\u00e1gina se redireccione a google.com. Esta vulnerabilidad podr\u00eda usarse en ataques de phishing al redirigir a los usuarios desde una URL de aplicaci\u00f3n leg\u00edtima a sitios maliciosos. Este problema se ha solucionado en la versi\u00f3n 1.5.11. Se recomienda a los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad."}], "lastModified": "2024-11-27T19:15:33.400", "sourceIdentifier": "security-advisories@github.com"}