Executive brief
Archivy is a personal knowledge management application that allows users to organize and retrieve information. The application contains an open redirect vulnerability that could allow an attacker to redirect users to arbitrary websites by crafting malicious links. An attacker could use this to perform phishing attacks or direct users to malicious content, potentially compromising user data or credibility.
Technical details
Archivy prior to version 1.7.1 is vulnerable to an open redirect flaw (CWE-601). The vulnerability exists in the redirect handling logic, where user-supplied input is not properly validated before being used in HTTP redirects. This allows an attacker to craft a malicious URL that redirects to an attacker-controlled domain. The attack requires user interaction (clicking a malicious link) and is network-accessible with no authentication required. An attacker can exploit this to perform credential harvesting or phishing attacks. The vulnerability was fixed in version 1.7.1, released in 2022.
Affected products
- Archivy archivy prior to 1.7.1
Timeline
- 2022-03-08: disclosed
- 2022-03-08: patched: Fixed in version 1.7.1