Executive Summary

This vulnerability is an open redirect issue in the Account module of the Volosoft ABP Framework versions >= 5.1.0 and < 10.0.0-rc.2. It occurs because the returnUrl parameter in the register function is not properly validated, allowing an attacker to redirect users to arbitrary external domains after registration. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to redirect users to malicious external websites after registration. This can be exploited for phishing attacks, stealing user credentials, or delivering malware by tricking users into trusting the redirected site. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by testing the 'returnUrl' parameter in the registration function of the Volosoft ABP Framework application. Specifically, try to access the registration endpoint with a manipulated 'returnUrl' parameter pointing to an external domain and observe if the application redirects to that external URL without proper validation. For example, you can use curl or similar tools to test the redirect behavior: curl -v "https://yourapp/register?returnUrl=https://malicious.example.com" and check if the response redirects to the external domain. Additionally, reviewing the source code for usage of direct redirects with the 'returnUrl' parameter can help identify vulnerable versions. Since the fix involves replacing direct Redirect calls with RedirectSafelyAsync, checking if your code uses the safe method can also indicate if the vulnerability is present. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, update your Volosoft ABP Framework to a version that includes the fix for CVE-2025-65581. The fix involves replacing the direct redirect call with a safer method that validates the 'returnUrl' parameter, specifically changing from 'return Redirect(ReturnUrl ?? "~/");' to 'return await RedirectSafelyAsync(ReturnUrl, ReturnUrlHash);' in the registration code. If updating is not immediately possible, review and modify your code to implement similar validation or sanitization of the 'returnUrl' parameter to prevent open redirects. Avoid using direct redirects with user-controlled URLs without validation. [1, 2]

Useful 0 Not Useful 0