thinkgem JeeSite Open Redirect Vulnerability in ServletUtils

An open redirect vulnerability has been identified in thinkgem JeeSite versions through 5.12.0. The issue arises in the `redirectUrl` function within `ServletUtils.java`, where user-controlled URL parameters are not properly validated, allowing for arbitrary redirection. This vulnerability can be exploited remotely, potentially leading to phishing attacks by misdirecting users to malicious sites.

Impact

Exploitation of this vulnerability allows for open redirection, where users can be sent to an external site of the attacker's choosing. This could be used in conjunction with other attacks, such as phishing.

Reproduction

To reproduce this vulnerability, send a request to the `/js/lang/cn` endpoint with a `url` parameter containing the desired redirect URL. The application will redirect the user to the specified URL, bypassing any security checks.

Remediation

Users are advised to update to the latest version of thinkgem JeeSite, where this vulnerability has been patched.