CVE-2024-21641 - Vulnerability Details - OpenCVE

Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Flarum	Flarum

Configuration 1 [-]

cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a
https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176
https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr

History

Fri, 17 Jan 2025 18:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-01-05T21:02:56.513Z

Updated: 2025-01-17T18:15:30.139Z

Reserved: 2023-12-29T03:00:44.957Z

Link: CVE-2024-21641

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-01-05T21:15:43.337

Modified: 2025-01-17T19:15:28.590

Link: CVE-2024-21641

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21641", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-29T03:00:44.957Z", "datePublished": "2024-01-05T21:02:56.513Z", "dateUpdated": "2025-01-17T18:15:30.139Z"}, "containers": {"cna": {"title": "Flarum's Logout Route allows open redirects", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr"}, {"name": "https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a", "tags": ["x_refsource_MISC"], "url": "https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a"}, {"name": "https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176", "tags": ["x_refsource_MISC"], "url": "https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176"}], "affected": [{"vendor": "flarum", "product": "framework", "versions": [{"version": "< 1.8.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-17T18:15:30.139Z"}, "descriptions": [{"lang": "en", "value": "Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe."}], "source": {"advisory": "GHSA-733r-8xcp-w9mr", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.096Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr"}, {"name": "https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a"}, {"name": "https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5C4E508-EB5A-43B9-B11C-81977B5BA70D", "versionEndExcluding": "1.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe."}, {"lang": "es", "value": "Flarum es un software de plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de la versi\u00f3n 1.8.5, la ruta `/logout` de Flarum incluye un par\u00e1metro de redirecci\u00f3n que permite a cualquier tercero redirigir a los usuarios desde un dominio (confiable) de la instalaci\u00f3n de Flarum para redirigir a cualquier enlace. Para los usuarios que han iniciado sesi\u00f3n, se debe confirmar el cierre de sesi\u00f3n. Los invitados son redirigidos inmediatamente. Los spammers podr\u00edan utilizar esto para redirigir a una direcci\u00f3n web utilizando un dominio confiable de una instalaci\u00f3n de Flarum en ejecuci\u00f3n. La vulnerabilidad ha sido reparada y publicada como flarum/core v1.8.5. Como workaround, algunas extensiones que modifican la ruta de cierre de sesi\u00f3n pueden solucionar este problema si su implementaci\u00f3n es segura."}], "id": "CVE-2024-21641", "lastModified": "2025-01-17T19:15:28.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-05T21:15:43.337", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/flarum/framework/commit/7d70328471cf3091d92d95c382d277aec7996176"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}