[Security] Open redirect with trailing slash redirect

[Rotzbua]

Environment

grav version: v1.6.31 - Admin v1.9.19
php: 7.4 and 7.2 tested

Problem

If grav is on root folder on a domain it seems there is a open redirect.

Fist analysis

Origin of the problem seems to be the redirect by setting Redirect trailing slash on.

Examples

Open redirect if on root folder:
https://yourdomain.example/%252f%255cwelovetoexploit%252fa%253fb/

Response header (short):

302 Found
location | /\welovetoexploit/a?b

It redirects to: welovetoexploit/a?b

---

Less(?) a problem if in subfolder:
https://yourdomain.example/gravsubfolder/%252f%255cwelovetoexploit%252fa%253fb/

Response header (short):

302 Found
location /gravsubfolder/\welovetoexploit/a?b

---

Current version 1.7 seems to be fixed example:
https://getgrav.org/%252f%255cwelovetoexploit%252fa%253fb/

Reference

• CVE-2020-11529
• 2eae104#commitcomment-39942387

[mahagr]

Seems to be non-issue in Grav 1.7.

[Rotzbua]

@mahagr Any plans to fix the security issue? Otherwise https://github.com/getgrav/grav/blob/develop/SECURITY.md must be updated.

[w00fz]

@mahagr Any plans to fix the security issue? Otherwise https://github.com/getgrav/grav/blob/develop/SECURITY.md must be updated.

@Rotzbua this is out of curiosity, are you actually unable to update to 1.7? If so, mind sharing the reasons? Trying to evaluate if this might actually be a possibility

[Rotzbua]

I currently evaluate the upgrate to 1.7 . But SECURITY.md states that 1.6 still gets security updates. So maybe some people think it is save to stick on 1.6, but this issue is still present. The open redirect does not require privileges so it has impact.

[w00fz]

That's why I was asking. We still want to have security fixes ported to 1.6, like the one you asked about, however I am thinking we shouldn't advertise support for 1.6 in that SECURITY.md file.

Mainly the problem is that on 1.6 all you can do is patch. We don't have, currently, an infrastructure that lets you update to the latest 1.6, you can only ever update to the latest stable version (1.7) or manually install the 1.6 package downloaded from GitHub.

The only reason one would decide to stick to 1.6 is mainly PHP version restrictions on the server hosting, otherwise we do advise to update to 1.7 always.

FYI, we are investigating the issue and i updated the SECURITY.md with the above.

[Rotzbua]

FYI, we are investigating the issue

👍

FYI: my upgrade from 1.6.31 to 1.7.7 was without any problems. Thanks for your great work.