TOTVS Portal Meu RH Open Redirect Vulnerability in Password Reset Handler

An open redirect vulnerability has been identified in TOTVS Portal Meu RH versions through 12.1.17. The issue arises in the Password Reset Handler component, where manipulation of the redirectUrl parameter can lead to unauthorized redirection. This vulnerability can be exploited remotely and has been publicly disclosed, with an available proof-of-concept exploit. The flaw allows attackers to redirect users to malicious external sites, facilitating phishing attacks.

Impact

Exploitation of this vulnerability could be used to conduct phishing attacks by redirecting users to malicious websites.

Remediation

Users are advised to upgrade to TOTVS Portal Meu RH versions 12.1.2410.274, 12.1.2502.178, or 12.1.2506.121.