Soumettre #904805: Intelliants Subrion CMS 4.2.1 Open Redirect

A post-login open redirect vulnerability was identified in Intelliants Subrion CMS 4.2.1. The login page handler in front/login.php stores the HTTP Referer header in $_SESSION['referrer'] whenever the value is not exactly equal to IA_SELF. The value's scheme and host are not validated. After a successful login, iaUsers::authorize() in includes/classes/ia.core.users.php passes the stored value directly to header('Location: ' . $_SESSION['referrer']). This allows an attacker-controlled site to send a victim to the legitimate Subrion login page and cause the authenticated victim to be redirected to an arbitrary external destination immediately after login.

Proof of Concept step 1:
GET /login/ HTTP/1.1
Host: TARGET
Referer: https://attacker.example/phish
Connection: close

Retain the returned session cookie and CSRF token. Then submit valid credentials using the same session:
POST /login/ HTTP/1.1
Host: TARGET
Cookie: INTELLI_SESSION=SESSION_VALUE
Content-Type: application/x-www-form-urlencoded
Connection: close

__st=CSRF_TOKEN&username=VALID_USER&password=VALID_PASSWORD&login=Login

Observed response:
HTTP/1.1 302 Found
Location: https://attacker.example/phish

In a browser-based attack, an attacker hosts a page linking to the legitimate Subrion login page. The browser supplies the attacker page as the Referer. When the victim logs in normally, Subrion redirects the victim back to the attacker-controlled site.

Affected components: front/login.php lines 54-56 and includes/classes/ia.core.users.php lines 162-166 in tag v4.2.1.
Affected input: HTTP Referer header.
Impact: the trusted authentication flow can be abused for phishing and social engineering. Victims can be redirected to a lookalike page immediately after authentication, making follow-up requests for credentials, MFA codes, or malicious downloads more credible.
Suggested CWE: CWE-601 URL Redirection to Untrusted Site.
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1).
Recommendation: store only application-relative post-login destinations, require a relative path beginning with a single slash or enforce a strict origin allowlist, and fall back to a fixed local profile or dashboard URL.

Source 1: https://github.com/intelliants/subrion/blob/v4.2.1/front/login.php#L54-L56
Source 2: https://github.com/intelliants/subrion/blob/v4.2.1/includes/classes/ia.core.users.php#L162-L166
Product: https://github.com/intelliants/subrion
Vendor notification: https://github.com/intelliants/subrion/issues/917
Full public advisory and PoC: https://github.com/volksec/SubrionCMS-Security-Advisories/issues/2

The issue was reproduced only against a clean local installation. No public Subrion infrastructure was tested. The vendor was contacted before this CVE request. No CVE is known to be assigned and the issue has not been submitted to another CNA.

• La source: ⚠️ https://github.com/volksec/SubrionCMS-Security-Advisories/issues/2
• Utilisateur: volksec (UID 93050)
• Soumission: 25/07/2026 04:27 (il y a 2 mois)
• Modérer: 23/09/2026 18:11 (2 months later)
• Statut: Accepté
• Entrée VulDB: 409028 [Intelliants Subrion CMS jusqu’à 4.2.1 Login Page front/login.php iaUsers::authorize $_SERVER['HTTP_REFERER'] Redirect]
• Points: 20