CVE-2020-13486: Knock Knock plugin Open redirection vulnerability
Summary
CVE-2020-13486: Knock Knock plugin Open redirection vulnerability. Affects verbb/knock-knock versions < 1.2.8. Fixed in 1.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Knock Knock plugin is a package for Craft CMS that provides functionality for managing redirects. It allows users to create and manage redirect rules to redirect incoming requests to different URLs. The plugin is widely used in Craft CMS websites to handle URL redirections.
Vulnerability Detail
The Knock Knock plugin before version 1.2.8 is affected by an open redirection vulnerability. This vulnerability allows an attacker to craft a malicious URL that can redirect users to arbitrary websites. By exploiting this vulnerability, an attacker can trick users into visiting malicious websites, potentially leading to further attacks such as phishing or malware installation. The vulnerability is considered moderate in severity with a CVSS score of 6.1.
How To Fix
Minimum fixed version
1.2.8
This is the first release that contains the fix.
composer require verbb/knock-knock:1.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Knock Knock plugin for Craft CMS is affected by an open redirection vulnerability. This vulnerability allows attackers to redirect users to arbitrary websites, potentially leading to further attacks. To mitigate the risk, it is crucial to upgrade the plugin to version 1.2.8 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for verbb/knock-knock →
FAQ
An open redirection vulnerability is a security flaw that allows an attacker to redirect users to arbitrary websites. It occurs when a web application accepts user-supplied input for redirect destinations without proper validation or sanitization. Attackers can exploit this vulnerability to trick users into visiting malicious websites.
An open redirection vulnerability can be used by attackers to conduct phishing attacks, where they trick users into visiting fake websites and stealing their sensitive information. It can also be used to distribute malware by redirecting users to websites that host malicious content.
You can use Vulert's playground at Vulert Scanner to check if your Craft CMS website is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file of your application.
Currently, there is no known workaround for this vulnerability. It is recommended to upgrade the Knock Knock plugin to the latest version to mitigate the risk.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance on fixing the vulnerability in your Craft CMS website.
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/knock-knock.
