Caido Improper Link Handling in Markdown Renderer Vulnerability Allowing Phishing Attacks

A vulnerability in Caido's web security auditing toolkit, prior to version 0.53.0, allowed for improper handling of user-supplied Markdown in the Findings page. This flaw enabled attacker-controlled links to be rendered without verification. Users opening findings generated by the scanner or other plugins could inadvertently click these injected links, leading the Caido application to an attacker-controlled domain and facilitating phishing-style attacks. The issue has been patched in version 0.53.0.

Impact

Exploitation of this vulnerability could lead to phishing attacks, where users are redirected to malicious domains controlled by an attacker.

Remediation

Users can upgrade to Caido version 0.53.0 or later to address this vulnerability.