Khoj Open Redirect Vulnerability in Login Page

published 2024-07-08 2y ago modified 2024-12-06 last yr.

cvss: 6.5; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Summary An attacker can use the `next` parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking `app.khoj.dev` url. For example, `https://app.khoj.dev/login?next=//example.com` will redirect to the https://example.com page.

### Details The problem seems to be in this method: https://github.com/khoj-ai/khoj/blob/2667ef45449eb408ce1d7c393be04845be31e15f/src/khoj/routers/auth.py#L95

### PoC Open the `https://app.khoj.dev/login?next=//example.com` url in a Gecko-based browser (Firefox).

### Impact The impact is low, and this could only be used in phishing attempts, but it's still a problem nonetheless.

Patch / fix

fixed in 1 links 1

pypi khoj-assistant 1.14.0

github.com/khoj-ai/khoj@4daf16e commit

Is GHSA-564j-v29w-rqr6 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	khoj-assistant	<1.14.0	1.14.0

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

Sources

GitHub Advisory GHSA-564j-v29w-rqr6

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.