Open redirect in change password functionality in Cacti

An attacker can craft a URL containing a malicious website in the `ref` parameter and trick a user with console access into clicking it. When the user performs a password change via this crafted URL, they will be redirected to the attacker-controlled site [ref_id=1]. This redirection can lead to malware downloads or credential harvesting [ref_id=1].

The `auth_changepassword.php` file is affected. Specifically, the `get_nfilter_request_var('ref')` function retrieves the value of the `ref` parameter, which is then used in a `header('Location: ...')` call after potentially being processed by `sanitize_uri` and `get_request_var` [ref_id=1]. The `sanitize_uri` function only cleans up for XSS, and `get_nfilter_request_var` defers filtering, allowing arbitrary URLs to be passed to the redirect function [ref_id=1].

The vulnerability is addressed in Cacti version 1.2.25. The advisory indicates that the `auth_changepassword.php` file accepts the `ref` URL parameter and uses it in a redirect via the `header` PHP function without sufficient validation [ref_id=1]. Users are advised to upgrade to version 1.2.25 to mitigate this issue.

Send to the target user a link like the following: `https://<cacti_installation>/auth_changepassword.php?ref=https://<malicious_website>`. After the change password operation, the browser will be redirected to the malicious website [ref_id=1].