FastGPT Open Redirect and DOM-Based Cross-Site Scripting Vulnerability

A vulnerability in FastGPT, an AI agent building platform, prior to version 4.9.12, allows for open redirects and DOM-based cross-site scripting (XSS) via the LastRoute parameter on the login page. The issue stems from inadequate validation and sanitization of the parameter, which enables attackers to execute malicious JavaScript or redirect users to sites controlled by the attacker.

Impact

Exploitation of this vulnerability could lead to unauthorized redirection of users or execution of malicious scripts in the context of the user's browser.

Remediation

Users can upgrade to FastGPT version 4.9.12 or later to address this vulnerability.