Halo Open Redirect Vulnerability Allowing Cross-Site Scripting

A vulnerability in Halo's Account Security Settings has been identified, specifically in the returnUrl parameter, which lacks proper input validation. This flaw allows attackers to redirect users to malicious websites (open redirect) and inject JavaScript code, potentially leading to cross-site scripting (XSS) attacks. The vulnerability affects Halo versions prior to 2.174.101 and all versions between 2.175.1 and 2.184.21.

Impact

Exploitation of this vulnerability could result in cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users with on-premises Halo instances should apply the latest stable or beta patch. Instructions for updating can be found in the Halo Knowledge Base.