Open Redirect Vulnerability in Leantime 3.6.2

Executive Summary

Leantime 3.6.2 has an open redirect vulnerability in its Login controller. This flaw allows unauthenticated attackers to manipulate the redirectUrl POST parameter to redirect authenticated users to arbitrary external websites. The vulnerability bypasses FILTER_SANITIZE_URL validation, enabling attackers to craft malicious login URLs that redirect victims to attacker-controlled sites for phishing or credential theft.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious login requests with manipulated redirectUrl parameters. Check web server logs for POST requests to /login with unusual redirectUrl values. Use tools like Wireshark or tcpdump to inspect HTTP traffic for open redirects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to phishing attacks where users are tricked into visiting malicious sites, potentially exposing login credentials or sensitive data. Users may unknowingly navigate to attacker-controlled domains, risking account compromise or malware infections.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling phishing attacks that steal credentials or sensitive data. Open redirects may violate data protection principles requiring secure authentication and user protection.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Leantime to the latest version beyond 3.6.2. Implement strict input validation for the redirectUrl parameter. Add allowlists for trusted domains. Configure web application firewalls to block requests with malicious redirectUrl values.

Useful 0 Not Useful 0