CVE-2024-24764: Open Redirect Vulnerability in October System module
Summary
CVE-2024-24764: October System module has an Open Redirect for Administrator Accounts. Affects october/system versions >= 3.2, < 3.5.15. Fixed in 3.5.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The October System module is a component of the OctoberCMS platform, which is an open-source content management system built on the Laravel framework. The System module provides core functionalities and utilities for managing the CMS. It is responsible for handling various administrative tasks, including user authentication and authorization. This vulnerability affects the System module in versions prior to v3.5.15.
Vulnerability Detail
The vulnerability identified as CVE-2024-24764 is an open redirect vulnerability that exists in the October System module. Authenticated administrators are susceptible to being redirected to untrusted URLs through the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, enabling an open redirect outside the scope of the active host. Exploiting this vulnerability requires access to the administration panel and interaction from another trusted user. The impact of this vulnerability is considered low.
How To Fix
Minimum fixed version
3.5.15
This is the first release that contains the fix.
composer require october/system:3.5.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patch or update the October System module to the latest version to mitigate the risk.
Conclusion
The open redirect vulnerability in the October System module could allow authenticated administrators to be redirected to untrusted URLs. However, the impact of this vulnerability is considered low, as it requires specific conditions to be met for exploitation. To mitigate the risk, it is recommended to update the October System module to version 3.5.15 or later.
See every vulnerability recorded for october/system →
FAQ
The vulnerability allows authenticated administrators to be redirected to untrusted URLs. However, exploiting this vulnerability requires access to the administration panel and interaction from another trusted user. The impact is considered low.
To fix this vulnerability, update the October System module to version 3.5.15 or later. This update includes a patch that addresses the open redirect issue.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided patch or update the October System module to the latest version.
No, this vulnerability requires authenticated access to the administration panel and interaction from another trusted user. It cannot be actively exploited without these conditions.
The vulnerability was discovered by Benzetaa and reported to the OctoberCMS team.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/system.
