opensearch-project security-dashboards-plugin up to 1.3.18/2.15.x nextUrl redirect

Summaryinfo

A vulnerability has been found in opensearch-project security-dashboards-plugin up to 1.3.18/2.15.x and classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument nextUrl results in redirect. This vulnerability is cataloged as CVE-2024-43794. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in opensearch-project security-dashboards-plugin up to 1.3.18/2.15.x. It has been classified as problematic. This affects an unknown part. The manipulation of the argument nextUrl with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is available in 1.3.19 and 2.16.0 for this issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-43794 since 08/16/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 1.3.19 or 2.16.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• opensearch-project

Name

• security-dashboards-plugin

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15

Website

• Product: https://github.com/opensearch-project/security-dashboards-plugin/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion