Listen to this Post
The vulnerability exists within the Shiro-based authentication login endpoint of Central Dogma. The `redirect` query parameter in the login request is not properly validated or sanitized before being used in the server’s response. When a user attempts to access a protected resource, they are redirected to `/login` with a `redirect` parameter containing their original intended URL. An attacker can craft a malicious login URL with a `redirect` parameter pointing to an external, attacker-controlled phishing site. When a victim clicks this link and completes the login process on the legitimate Central Dogma server, the server automatically redirects the user’s browser to the URL specified in the tainted `redirect` parameter. This redirection happens post-authentication, lending credibility to the malicious site, which can then harvest the user’s freshly entered credentials or session tokens.
Platform: Central Dogma
Version: < 0.78.0
Vulnerability: Open Redirect
Severity: Moderate
Date: Dec 4, 2025
Prediction: Patched (0.78.0)
What Undercode Say:
Check Central Dogma version java -jar centraldogma-server.jar --version Simulate malicious redirect attempt curl -I "http://target/login?redirect=https://evil-phish.com"
// Example of unsafe redirect in a Shiro filter (conceptual)
String redirectUrl = request.getParameter("redirect");
response.sendRedirect(redirectUrl); // Vulnerable
How Exploit:
- Attacker crafts URL:
http://[bash]/login?redirect=https://attacker.com/fake-login`attacker.com`.
<h2 style="color: blue;">2. Victim clicks link, authenticates on real server.</h2>
<h2 style="color: blue;">3. Server redirects victim to - Victim sees a cloned login page and may re-enter credentials.
Protection from this CVE
– Upgrade to Central Dogma version 0.78.0.
– Implement custom `AuthProvider` to validate redirect URLs in webLoginService().
– Apply allow-list validation for all redirect URLs.
Impact:
Phishing attacks, credential theft, account compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
