Executive Summary

This vulnerability exists in Casdoor version 2.356.0 within the OAuth Authorization Request Handler component. It involves manipulation of the redirect_uri argument, which leads to an open redirect vulnerability. This means an attacker can craft a URL that redirects users to a malicious site.

The attack can be launched remotely and the exploit is publicly available. The vendor was informed early but did not respond.

Useful 0 Not Useful 0

Impact Analysis

The open redirect vulnerability can be exploited by attackers to redirect users to malicious websites without their knowledge. This can lead to phishing attacks, where users might be tricked into providing sensitive information or downloading malware.

Since the vulnerability requires user interaction (UI:R in CVSS v3.1), the impact depends on users clicking on crafted links. However, it can still undermine user trust and potentially lead to security breaches.

Useful 0 Not Useful 0