MEDIUM Mautic Vulnerability Alert

This advisory addresses an Open Redirection vulnerability in Mautic’s user unlocking endpoint. An attacker could exploit this vulnerability to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. The vulnerability exists due to improper validation of the returnUrl parameter in the /s/action/unlock/user.user/0 endpoint.

Details

Exploitation
To exploit this vulnerability, an attacker can craft a malicious URL that includes a manipulated returnUrl parameter. When a legitimate user clicks on this URL, they will be redirected to an external site controlled by the attacker, which could be used for phishing or delivering malware.

Affected Products

• Mautic user unlocking endpoint: Vulnerable due to improper validation of the returnUrl parameter, allowing redirection to arbitrary external sites.

Mitigation
To mitigate this vulnerability, it is recommended to update Mautic to a version that properly validates or sanitizes the returnUrl parameter. This ensures that redirects only occur to trusted internal URLs or explicitly whitelisted domains.

References

• Mautic Security Advisory