Executive brief
OpenRun, a Go-based development tool, is vulnerable to an open redirect flaw. Attackers can trick users into visiting a malicious website by providing a specially crafted link that appears to belong to a trusted domain. This can be used in phishing campaigns to steal user credentials or distribute malware by making harmful external links look legitimate.
Technical details
An open redirect vulnerability exists in OpenRun due to insufficient validation of the Referer header used for redirects. The validation logic checks if the host and schema match the current site but fails to account for protocol-relative paths (e.g., //example.com) in the path component. An attacker can bypass the check by providing a URL like 'http://trusted.com//malicious.com'; the validator sees 'trusted.com' as the host, but the application subsequently redirects the user to '//malicious.com', which browsers interpret as a cross-domain link. This allows for unauthenticated, remote redirection of users to arbitrary external domains. The issue is fixed in version 0.17.7.
Affected products
- openrundev openrun < 0.17.7
Timeline
- 2026-06-02: disclosed: Vulnerability reported by Fushuling and RacerZ-fighting
- 2026-07-09: advisory: GitHub Advisory GHSA-h5g6-xmh4-hc37 published
- 2026-07-09: patched: Fixed in version 0.17.7