CVE-2023-5375: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-10-04T09:15Z
Repository: https://github.com/mosparo/mosparo
Language: PHP
Files changed: src/Controller/ProjectController.php
Commit date: 2023-10-02 17:44:04 +0200
Commit message: Fixed an open redirect in the project switch functionality.
Reported by @tomorroisnew on huntr.dev

Diff: diff --git a/src/Controller/ProjectController.php b/src/Controller/ProjectController.php
index 21c93c3..5486057 100644
--- a/src/Controller/ProjectController.php
+++ b/src/Controller/ProjectController.php
@@ -392,11 +392,11 @@ class ProjectController extends AbstractController
             return $this->redirectToRoute('project_list');
         }
 
         // Redirect back to the originally requested path
         $targetPath = $request->query->get('targetPath', false);
-        if ($targetPath) {
+        if ($targetPath && $this->isLocalUrl($request, $targetPath)) {
             return $this->redirect($targetPath);
         }
 
         return $this->redirectToRoute('dashboard');
     }
@@ -409,6 +409,24 @@ class ProjectController extends AbstractController
 
         $request->getSession()->set('activeProjectId', $project->getId());
 
         return true;
     }
+
+    protected function isLocalUrl(Request $request, $url): bool
+    {
+        // If the first character is a slash, the URL is relative (only the path) and is local
+        if (str_starts_with($url, '/')) {
+            return true;
+        }
+
+        // If the URL is absolute but starts with the host of mosparo, we can redirect it.
+        // Add the slash to prevent a redirect when a similar top-level domain is used.
+        // For example, mosparo.com should not allow a redirect to mosparo.com.au
+        if (str_starts_with($url, $request->getSchemeAndHttpHost() . '/')) {
+            return true;
+        }
+
+        // The URL does not match the two checks because it's an external URL; no redirect in that case.
+        return false;
+    }
 }
\ No newline at end of file

Vulnerable code:         if ($targetPath) {
Fixed code:         if ($targetPath && $this->isLocalUrl($request, $targetPath)) {

    protected function isLocalUrl(Request $request, $url): bool
    {
        // If the first character is a slash, the URL is relative (only the path) and is local
        if (str_starts_with($url, '/')) {
            return true;
        }

        // If the URL is absolute but starts with the host of mosparo, we can redirect it.
        // Add the slash to prevent a redirect when a similar top-level domain is used.
        // For example, mosparo.com should not allow a redirect to mosparo.com.au
        if (str_starts_with($url, $request->getSchemeAndHttpHost() . '/')) {
            return true;
        }

        // The URL does not match the two checks because it's an external URL; no redirect in that case.
        return false;
    }