CVE-2015-8474: Other (NVD-CWE-Other)
value: Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.4
Published: 2016-04-12T14:59Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: app/controllers/application_controller.rb, test/functional/account_controller_test.rb
Commit date: 2015-09-13 14:35:20 +0000
Commit message: Open redirect vulnerability (#19577).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@14560 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 5949f47b6..9f307c3e2 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -394,46 +394,64 @@ class ApplicationController < ActionController::Base
     url
   end
 
   def redirect_back_or_default(default, options={})
     back_url = params[:back_url].to_s
-    if back_url.present? && valid_back_url?(back_url)
-      redirect_to(back_url)
+    if back_url.present? && valid_url = validate_back_url(back_url)
+      redirect_to(valid_url)
       return
     elsif options[:referer]
       redirect_to_referer_or default
       return
     end
     redirect_to default
     false
   end
 
-  # Returns true if back_url is a valid url for redirection, otherwise false
-  def valid_back_url?(back_url)
+  # Returns a validated URL string if back_url is a valid url for redirection,
+  # otherwise false
+  def validate_back_url(back_url)
     if CGI.unescape(back_url).include?('..')
       return false
     end
 
     begin
       uri = URI.parse(back_url)
     rescue URI::InvalidURIError
       return false
     end
 
-    if uri.host.present? && uri.host != request.host
+    [:scheme, :host, :port].each do |component|
+      if uri.send(component).present? && uri.send(component) != request.send(component)
+        return false
+      end
+      uri.send(:"#{component}=", nil)
+    end
+    # Always ignore basic user:password in the URL
+    uri.userinfo = nil
+
+    path = uri.to_s
+    # Ensure that the remaining URL starts with a slash, followed by a
+    # non-slash character or the end
+    if path !~ %r{\A/([^/]|\z)}
       return false
     end
 
-    if uri.path.match(%r{/(login|account/register)})
+    if path.match(%r{/(login|account/register)})
       return false
     end
 
-    if relative_url_root.present? && !uri.path.starts_with?(relative_url_root)
+    if relative_url_root.present? && !path.starts_with?(relative_url_root)
       return false
     end
 
-    return true
+    return path
+  end
+  private :validate_back_url
+
+  def valid_back_url?(back_url)
+    !!validate_back_url(back_url)
   end
   private :valid_back_url?
 
   # Redirects to the request referer if present, redirects to args or call block otherwise.
   def redirect_to_referer_or(*args, &block)
diff --git a/test/functional/account_controller_test.rb b/test/functional/account_controller_test.rb
index e7b4c4fc1..362af68a2 100644
--- a/test/functional/account_controller_test.rb
+++ b/test/functional/account_controller_test.rb
@@ -61,10 +61,11 @@ class AccountControllerTest < ActionController::TestCase
 
   def test_login_should_redirect_to_back_url_param
     # request.uri is "test.host" in test environment
     back_urls = [
       'http://test.host/issues/show/1',
+      'http://test.host/',
       '/'
     ]
     back_urls.each do |back_url|
       post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
       assert_redirected_to back_url
@@ -106,11 +107,19 @@ class AccountControllerTest < ActionController::TestCase
       'http://test.host/',
       'http://test.host/fake',
       'http://test.host/fake/issues',
       'http://test.host/redmine/../fake',
       'http://test.host/redmine/../fake/issues',
-      'http://test.host/redmine/%2e%2e/fake'
+      'http://test.host/redmine/%2e%2e/fake',
+      '//test.foo/fake',
+      'http://test.host//fake',
+      'http://test.host/\n//fake',
+      '//bar@test.foo',
+      '//test.foo',
+      '////test.foo',
+      '@test.foo',
+      'fake@test.foo'
     ]
     back_urls.each do |back_url|
       post :login, :username => 'jsmith', :password => 'jsmith', :back_url => back_url
       assert_redirected_to '/my/page'
     end

Vulnerable code:     if back_url.present? && valid_back_url?(back_url)
      redirect_to(back_url)
  # Returns true if back_url is a valid url for redirection, otherwise false
  def valid_back_url?(back_url)
    if uri.host.present? && uri.host != request.host
    if uri.path.match(%r{/(login|account/register)})
    if relative_url_root.present? && !uri.path.starts_with?(relative_url_root)
    return true
      'http://test.host/redmine/%2e%2e/fake'
Fixed code:     if back_url.present? && valid_url = validate_back_url(back_url)
      redirect_to(valid_url)
  # Returns a validated URL string if back_url is a valid url for redirection,
  # otherwise false
  def validate_back_url(back_url)
    [:scheme, :host, :port].each do |component|
      if uri.send(component).present? && uri.send(component) != request.send(component)
        return false
      end
      uri.send(:"#{component}=", nil)
    end
    # Always ignore basic user:password in the URL
    uri.userinfo = nil

    path = uri.to_s
    # Ensure that the remaining URL starts with a slash, followed by a
    # non-slash character or the end
    if path !~ %r{\A/([^/]|\z)}
    if path.match(%r{/(login|account/register)})
    if relative_url_root.present? && !path.starts_with?(relative_url_root)
    return path
  end
  private :validate_back_url

  def valid_back_url?(back_url)
    !!validate_back_url(back_url)
      'http://test.host/',
      'http://test.host/redmine/%2e%2e/fake',
      '//test.foo/fake',
      'http://test.host//fake',
      'http://test.host/\n//fake',
      '//bar@test.foo',
      '//test.foo',
      '////test.foo',
      '@test.foo',
      'fake@test.foo'