Open Redirect Vulnerability in Invoice Ninja Client Portal

Executive Summary

Invoice Ninja versions up to 5.13.26 have an open redirect vulnerability in the client portal login. This means that an attacker can create a specially crafted login link containing a malicious external URL in the intended query parameter. When a victim uses this link and logs in, the application redirects them to the attacker-controlled external URL without validating the host. This happens because the intended parameter is stored in the session and then used directly in a redirect after login.

This vulnerability allows unauthenticated attackers to trick authenticated users into visiting malicious websites, enabling phishing attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests to the client portal login endpoint that include the `intended` query parameter with external URLs.

You can look for suspicious login URLs containing the `intended` parameter pointing to domains outside your trusted application domain.

For example, using command-line tools like curl or grep on server logs to find such requests:

• grep -i 'intended=http' /var/log/nginx/access.log
• grep -i 'intended=http' /var/log/apache2/access.log
• curl -I 'https://your-invoice-ninja-domain.com/client/login?intended=http://malicious-site.com'

Additionally, inspecting the application code or session handling to verify if the `intended` parameter is validated against allowed hosts can help detect the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by enabling attackers to redirect your authenticated users to malicious external websites. This can lead to phishing attacks where users might be tricked into revealing sensitive information or downloading malware. It undermines user trust and can potentially lead to credential theft or other security breaches.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to redirect authenticated users to attacker-controlled external URLs, enabling phishing attacks by exploiting the trust in the legitimate Invoice Ninja domain.

Such phishing attacks can lead to unauthorized disclosure of sensitive personal or health information if users are tricked into submitting data on malicious sites, potentially impacting compliance with standards like GDPR and HIPAA that require protection of personal and health data.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include validating the `intended` query parameter to ensure it only contains URLs within the trusted application domain before storing it in the session.

You should update Invoice Ninja to a version later than 5.13.26 where this issue is fixed.

If an update is not immediately possible, apply a patch or modify the code in `ContactLoginController.php` to validate or sanitize the `intended` parameter, or use Laravel's built-in `redirect()->intended()` method with proper validation.

Additionally, monitor and block suspicious login URLs containing external redirects to prevent phishing attacks.

Useful 0 Not Useful 0