Open Redirect in Subrion CMS via HTTP_REFERER

Executive Summary

This vulnerability is an open redirect issue in Intelliants Subrion CMS versions up to 4.2.1. It occurs in the login page where the application stores the HTTP Referer header value in the user's session without proper validation. After login, the stored Referer is used to redirect users, allowing attackers to send victims to malicious sites immediately after authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the HTTP Referer header handling in Subrion CMS login functionality. Check if the application stores and uses the Referer header without validating its scheme or host. Review session data after login attempts to see if arbitrary URLs are stored and used for redirection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited in phishing and social engineering attacks. Attackers can trick users into visiting malicious pages right after they log in to a legitimate Subrion CMS site. This may lead to credential theft, malware infections, or other malicious activities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing and social engineering attacks. If an attacker redirects users to a malicious site post-login, it may lead to unauthorized data access or disclosure, violating confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Subrion CMS to the latest version if available. If not, implement strict validation for the HTTP Referer header, ensuring only application-relative or allowlisted destinations are used for post-login redirection. Redirect to a fixed local page if validation fails.

Useful 0 Not Useful 0