CVE-2017-11718 in MetInfo
Summary
by MITRE
There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2019
The vulnerability identified as CVE-2017-11718 represents a critical security flaw in MetInfo content management systems version 5.3.17 and earlier, specifically targeting the URL redirector functionality within the member login module. This issue stems from inadequate input validation and sanitization mechanisms that fail to properly handle malicious redirect URLs, creating an avenue for attackers to manipulate the authentication flow. The vulnerability manifests through the gourl parameter in the member/login.php endpoint, which is designed to redirect users after successful authentication but becomes exploitable when crafted maliciously.
The technical implementation of this vulnerability resides in the improper handling of URL parameters within the application's redirect logic. When the gourl parameter is submitted to member/login.php, the system does not sufficiently validate or sanitize the input before processing it as a redirect destination. This allows an attacker to inject arbitrary URLs that can redirect users to malicious domains, potentially leading to phishing attacks, credential theft, or social engineering campaigns. The flaw falls under CWE-601 URL Redirector Abuse, which specifically addresses the insecure handling of redirect parameters that can be manipulated to lead users to unintended destinations. The vulnerability is particularly concerning because it operates at the authentication layer, where users are already in a trusted state, making it easier to exploit for more sophisticated attacks.
The operational impact of this vulnerability extends beyond simple redirection attacks, as it can be leveraged in combination with other techniques to create more severe security breaches. An attacker could craft malicious URLs that redirect users to phishing pages designed to capture login credentials, or direct them to exploit delivery pages that host malware. The vulnerability's presence in the member login functionality makes it particularly dangerous as it can be exploited by both authenticated and unauthenticated users, depending on the specific implementation details. From an attacker's perspective, this represents a low-effort, high-impact vector that can be easily automated and scaled across multiple targets. The issue aligns with ATT&CK technique T1566.001 for credential access through phishing and T1566.002 for spearphishing attacks, as it can be used to facilitate social engineering campaigns that bypass traditional security controls.
Mitigation strategies for CVE-2017-11718 require immediate implementation of input validation and sanitization measures within the application's redirect handling logic. Organizations should implement strict URL validation that ensures redirect destinations are either hardcoded within the application or explicitly whitelisted against known safe domains. The recommended approach involves removing the gourl parameter from the login flow or implementing robust parameter sanitization that strips out potentially dangerous URL schemes and domains. Additionally, implementing proper access controls and monitoring for unusual redirect patterns can help detect exploitation attempts. The fix should also include logging all redirect operations for security auditing purposes, as outlined in industry best practices for secure application development. Regular security assessments and code reviews should be conducted to identify similar vulnerabilities in other parts of the application, particularly in authentication and session management modules. Organizations should also consider implementing web application firewalls that can detect and block suspicious redirect patterns, and ensure that all systems are updated to the latest patched versions of MetInfo to eliminate this vulnerability entirely.