CVE-2025-11222

Vulnerability

Overview

Central Dogma versions prior to 0.78.0 contain an open redirect vulnerability that allows an attacker to redirect users to arbitrary external sites via specially crafted URLs [1][4]. The root cause lies in the login redirect logic, which incorrectly handles certain HTTP status codes; specifically, the application would redirect users to the login page even when a 403 Forbidden error occurred, indicating the user was already authenticated but lacked permissions [2][3]. This behavior could be abused by an attacker to craft a URL that, after authentication, redirects the victim to an untrusted destination.

Exploitation

An attacker can exploit this vulnerability by sending a victim a malicious link that appears legitimate but contains a crafted redirect parameter. When the victim clicks the link and authenticates (or is already authenticated), the application's flawed redirect logic sends them to an attacker-controlled site [4]. No special privileges are required beyond the ability to craft a URL and trick a user into clicking it. The vulnerability is present in the Shiro authentication flow used by Central Dogma [4].

Impact

Successful exploitation enables an attacker to redirect users to a phishing website that mimics the Central Dogma login page. This can lead to credential theft and unauthorized access to the victim's Central Dogma account [1][4]. The open redirect could also be used in broader social engineering campaigns to deliver malware or steal sensitive information.

Mitigation

The vulnerability is fixed in Central Dogma version 0.78.0 [4]. Server operators using Shiro authentication are strongly advised to upgrade immediately. As a workaround, administrators can implement a custom AuthProvider that overrides the webLoginService() method to prevent the redirect [4]. No other mitigations are documented.