Executive brief
Serendipity, a popular open-source PHP blogging engine, contains a security flaw that allows attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can send them to a fraudulent site that looks legitimate, increasing the success of phishing attacks and potentially leading to credential theft. This issue affects the comment management component of the software.
Technical details
An open redirect vulnerability exists in 'comment.php' within Serendipity versions up to and including 2.0.5. The application fails to properly validate the 'HTTP_REFERER' header before using it in a 302 redirect location. A remote attacker can exploit this by inducing a user to visit a crafted URL that triggers a redirect to an external, untrusted domain. This is primarily used to facilitate phishing campaigns or bypass security filters that trust the original domain. The fix involves implementing a check to ensure the referrer matches the 'HTTP_HOST' of the blog.
Affected products
- s9y Serendipity Through 2.0.5
Timeline
- 2017-01-14: disclosed
- 2017-01-14: advisory