Open Redirect in ikus060/rdiffweb

Overview

The vulnerability is an open redirect in Rdiffweb versions prior to 2.5.4. The root cause is improper handling of the X-Forwarded-Host HTTP header. The application did not discard or validate this header, allowing an attacker to supply an arbitrary host value that the server would then use to generate redirect URLs. [1][4]

Exploitation

An attacker can exploit this by sending a crafted request to any Rdiffweb instance that includes a malicious X-Forwarded-Host header. No authentication is required, and the attack can be performed over the network. When the server processes the request, it constructs a redirect URL based on the attacker-supplied host, which may point to a phishing site or other malicious destination. [2][4] The fix in commit 5f86167 explicitly discards X-Forwarded-Host headers by setting the local parameter to None in the CherryPy proxy tool. [4]

Impact

A successful open redirect can be used to trick users into visiting attacker-controlled websites, leading to potential credential theft, malware installation, or other social engineering attacks. The vulnerability is rated high severity (CVSS score not provided in the description, but assessed as high). [2]

Mitigation

The vulnerability is fixed in Rdiffweb version 2.5.4. Users should upgrade to this or a later version immediately. There is no evidence of exploitation in the wild (no KEV listing). The fix was applied in commit 5f861670ef8f38ca8eea52a98672d0e0fabb5368. [2][4]