Kanboard Open Redirect Vulnerability

A vulnerability allowing open redirects has been identified in Kanboard versions through 1.2.48. This issue arises from improper validation of redirect URLs, specifically protocol-relative URLs, which can be exploited to redirect authenticated users to malicious websites. The vulnerability could be used for phishing attacks, credential theft, or malware distribution. The issue has been fixed in version 1.2.49.

Impact

Exploitation of this vulnerability allows for open redirects to attacker-controlled websites, which can be used to conduct phishing attacks, steal user credentials, or distribute malware.

Reproduction

To reproduce this vulnerability, send a link containing a protocol-relative URL (e.g., //evil.com) to a user. When the user clicks the link, Kanboard will store the URL in the session and redirect them to the login page. After logging in, they will be redirected to the attacker-controlled site, bypassing the URL validation.

Remediation

Users can update to Kanboard version 1.2.49 or later, where this vulnerability has been fixed.