Ksenia Security Lares URL Redirection Vulnerability

A URL redirection vulnerability has been identified in Ksenia Security Lares version 4.0, specifically in the 'cmdOk.xml' script. This vulnerability allows attackers to manipulate the 'redirectPage' GET parameter, creating malicious links that can redirect authenticated users to arbitrary websites. The exploitation occurs when users click on these crafted links, which are hosted on trusted domains.

Impact

Exploitation of this vulnerability could lead to unauthorized redirection of users to malicious websites, potentially causing phishing or other spoofing-related attacks.

Reproduction

To reproduce this vulnerability, send a request to the 'cmdOk.xml' script with the 'redirectPage' parameter set to a URL of an arbitrary website. This can be done by clicking on a link hosted on a trusted domain that points to the affected script with the manipulated parameter.