Hunvreus DevPush Open Redirect Vulnerability in Google Authorization Endpoint

A vulnerability allowing open redirection has been identified in Hunvreus DevPush version 0.3.2. This issue resides in the Google authorization endpoint of the application. Attackers can exploit this vulnerability by sending users a crafted URL that redirects them to a malicious site.

Impact

Exploitation of this vulnerability could lead to phishing attacks, where users are redirected to fraudulent websites that may impersonate legitimate services or collect sensitive information.

Reproduction

To reproduce this vulnerability, send an authenticated user a crafted URL that includes the 'next' parameter pointing to an external domain. The URL should be formatted to include the DevPush host and the '/api/google/authorize' endpoint.

Remediation

Users can update to Hunvreus DevPush version 0.3.2 or later, where this vulnerability has been addressed.