CodeChecker, Open Redirect Vulnerability, CVE-2025-XXXX (Moderate)

By /

How the Mentioned CVE Works:

The vulnerability in CodeChecker versions up to 6.24.5 arises due to improper handling of URLs containing multiple slashes after the product name in the path segment. When processing GET requests, CodeChecker rewrites the URL path but fails to sanitize the remaining URL after trimming the product name. This oversight reintroduces an open redirect issue similar to CVE-2021-28861. Attackers can craft malicious URLs like /Default//attacker.com/%2f..., which appear legitimate but redirect users to malicious sites. This bypasses existing protections, enabling phishing attacks or redirecting users to harmful content.

DailyCVE Form:

Platform: CodeChecker

Version: Up to 6.24.5

Vulnerability: Open Redirect

Severity: Moderate

Date: Feb 28, 2025

What Undercode Say:

Exploitation:

  1. Attackers craft URLs with multiple slashes after the product name, e.g., /Default//attacker.com/%2f....
  2. The URL appears legitimate but redirects to a malicious site when clicked.

3. Exploit code example:

<a href="https://codechecker.example.com/Default//attacker.com/%2f...">Click Me</a>

4. Use tools like `curl` to test the vulnerability:

curl -I "https://codechecker.example.com/Default//attacker.com/%2f..."

5. Monitor HTTP response headers for unexpected redirects.

Protection:

  1. Update CodeChecker to the latest version beyond 6.24.5.
  2. Implement URL sanitization to remove multiple slashes and validate paths.

3. Use regex to filter malicious URLs:

import re
def sanitize_url(url):
return re.sub(r'/{2,}', '/', url)

4. Configure web application firewalls (WAFs) to block suspicious redirects.
5. Educate users to avoid clicking on untrusted links.

References:

Analytics:

  • Affected versions: 6.24.5 and below.
  • Exploitability: Low to Moderate.
  • Impact: Phishing, user redirection to malicious sites.
  • Patch Availability: Yes, in versions post 6.24.5.

Commands:

  • Check for vulnerable versions: 
    codechecker --version
  • Test for open redirects: 
    curl -I "https://codechecker.example.com/Default//attacker.com/%2f..."

Code Snippets:

  • Python URL sanitization: 
    import re
def sanitize_url(url):
return re.sub(r'/{2,}', '/', url)

URLs:

References:

Reported By: https://github.com/advisories/GHSA-g839-x3p3-g5fm
Extra Source Hub:
Undercode

Image Source:

Undercode AI DI v2Featured Image

Scroll to Top