CVE-2024-57241
Published: 11 February 2025
Description
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Security Summary
CVE-2024-57241 is an open redirect vulnerability (CWE-601) affecting Dedecms versions 5.71sp1 and earlier. The flaw arises from a logic error in the web application that fails to validate input from GET requests, enabling arbitrary URL redirection.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Per the CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), exploitation leads to low impacts on confidentiality and integrity, with no availability disruption, typically allowing attackers to redirect users to malicious sites for phishing or similar follow-on attacks.
A reference implementation or proof-of-concept for the vulnerability is available at https://github.com/woshidaheike/dedecms-url-redirection.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Open URL redirection vulnerability enables attackers to craft deceptive links on the vulnerable Dedecms site that redirect users to arbitrary malicious domains, facilitating spearphishing link attacks (T1566.002).