Open Redirect on login in go-gitea/gitea

Vulnerability

Gitea versions prior to 1.16.5 contain an open redirect vulnerability during the login process. The issue occurs because the software accepts redirection locations that begin with a backslash followed by a forward slash (/\), which browsers interpret as a protocol-relative URL (//), allowing an attacker to redirect users to arbitrary external domains. This was fixed in pull request #19175 by rejecting such malformed redirect paths [1] [4].

Exploitation

An attacker can exploit this vulnerability by crafting a login URL that includes a malicious redirect parameter starting with /\ followed by an external domain (e.g., /\attacker.com). No authentication or special access is required; the attacker only needs to trick a victim into clicking such a link. The browser then interprets the path as a protocol-relative URL and redirects the user to the attacker-controlled site after a successful login [1] [4].

Impact

Successful exploitation allows an attacker to redirect a victim to an arbitrary external website after login. This can be used for phishing attacks, credential theft, or distributing malware, compromising the victim's trust and security. The vulnerability is classified as open redirect (CWE-601) with a CVSS score indicating medium severity [3].

Mitigation

The vulnerability is fixed in Gitea version 1.16.5, released on or around March 23, 2022. Administrators should upgrade to this version or later. No workaround other than patching is available. The commit that resolves the issue is e3d8e92bdc67562783de9a76b5b7842b68daeb48 [3]. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.