Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Issue #1311: Fixed an open redirect in ExternalURLJump. Thanks to ama…
…mmad for disclosing it to us.
  • Loading branch information
Sven committed Oct 8, 2021
1 parent 741a845 commit de22bd9
Showing 1 changed file with 25 additions and 1 deletion.
26 changes: 25 additions & 1 deletion Kernel/Modules/ExternalURLJump.pm
Expand Up @@ -20,7 +20,9 @@ use strict;
use warnings;

our @ObjectDependencies = (
'Kernel::Config',
'Kernel::Output::HTML::Layout',
'Kernel::System::Log',
'Kernel::System::Web::Request',
);

Expand All @@ -39,10 +41,32 @@ sub Run {

my $LayoutObject = $Kernel::OM->Get('Kernel::Output::HTML::Layout');
my $ParamObject = $Kernel::OM->Get('Kernel::System::Web::Request');
my $ConfigObject = $Kernel::OM->Get('Kernel::Config');

my $ExtURL = $ParamObject->GetParam( Param => 'URL' );

return $LayoutObject->Redirect( ExtURL => $ExtURL );
# check whether the URL is defined in the Config - prevents using OTOBO for phishing attacks
my $NavAgent = $ConfigObject->Get('Frontend::Navigation');
my $NavCustomer = $ConfigObject->Get('CustomerFrontend::Navigation');

my @URLSets = ( $NavAgent && $NavAgent->{ExternalURLJump} ) ? ( values %{ $NavAgent->{ExternalURLJump} } ) : ();
push @URLSets, ( $NavCustomer && $NavCustomer->{ExternalURLJump} ) ? ( values %{ $NavCustomer->{ExternalURLJump} } ) : ();

for my $Set ( @URLSets ) {
LINK:
for my $Links ( @{ $Set } ) {
next LINK if $Links->{Link} !~ /$ExtURL/;

return $LayoutObject->Redirect( ExtURL => $ExtURL );
}
}

$Kernel::OM->Get('Kernel::System::Log')->Log(
Priority => 'info',
Message => "Prevented ExternalURLJump to '$ExtURL' because the link is not configured.",
);

return $LayoutObject->Redirect( OP => ' ' );
}

1;

0 comments on commit de22bd9

Please sign in to comment.