Sylius has an Open Redirect via Referer Header

Sylius, an open-source eCommerce framework on Symfony, contains an open redirect vulnerability in three controllers: CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction(), and StorageBasedLocaleSwitcher::handle(). These endpoints directly use the HTTP Referer header to determine the redirect destination without validation [1].

An attacker can craft a link to a legitimate Sylius endpoint, hosted on an attacker-controlled page. When a victim clicks the link, the browser automatically sends the attacker's site URL as the Referer header. The application then redirects the victim to that attacker-controlled URL, which appears to originate from a trusted domain [2]. For public endpoints like currency and locale switching, no authentication is required. The admin impersonation endpoint requires an authenticated session, but remains exploitable if an admin follows a link from an external source such as email or chat [1].

This open redirect can be leveraged for phishing attacks or credential theft, as the redirect originates from a trusted Sylius domain, making malicious sites appear legitimate [1]. The severity varies by endpoint: public endpoints present a low barrier to exploitation, while admin endpoints require prior authentication but are still vulnerable [2].

The issue is fixed in Sylius versions 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3, and above [1]. As a workaround, affected classes can be copied from vendor to the project's src/ directory, patched, and service definitions overridden [1].