CVE-2024-21641

Executive Summary

CVE-2024-21641 is an open redirect vulnerability in Flarum, an open-source discussion platform. The /logout route accepts a return parameter that allows an attacker to redirect users to any external URL after logout. For guest users, the redirect is immediate without confirmation, while logged-in users must confirm the logout action. This flaw can be exploited by spammers and phishers to craft links that appear to originate from a trusted Flarum domain, leading users to malicious sites. The vulnerability is fixed in version 1.8.5.

Supply Chain & Package Security

Flarum is a PHP-based package distributed via Composer. The vulnerable component is flarum/core. Organizations using Flarum should verify their composer.json for the version constraint and update to ^1.8.5 or later. The fix is a server-side validation of the redirect URL, ensuring it is relative or within the same origin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user clicks link)
• Scope: Changed
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the low complexity and potential for phishing attacks. The EPSS score is 0.32766 (97th percentile), indicating active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the /logout route handler. When a user visits /logout?return=http://attacker.com, the application processes the logout and then issues a redirect to the URL specified in the return parameter. The application does not validate that the redirect URL is relative or belongs to the same origin. This allows an attacker to craft a link like https://trusted-forum.example.com/logout?return=http://phishing-site.com. When a guest user clicks this link, they are immediately logged out and redirected to the phishing site. For logged-in users, a confirmation page is shown, but the redirect still occurs after confirmation.

The core issue is a lack of URL validation in the redirect logic. The fix in version 1.8.5 implements a whitelist or relative URL check to ensure the redirect target is safe.

Vulnerable vs. Patched Code

Vulnerable Code (Flarum < 1.8.5):

// In LogoutController.php
public function handle(Request $request): Response
{
    // ... logout logic ...
    $return = $request->get('return');
    if ($return) {
        return new RedirectResponse($return);
    }
    // ... default redirect ...
}

Patched Code (Flarum >= 1.8.5):

// In LogoutController.php
public function handle(Request $request): Response
{
    // ... logout logic ...
    $return = $request->get('return');
    if ($return) {
        // Validate that the URL is relative or same origin
        if (Url::isRelative($return) || Url::isSameOrigin($return, $request->getUri())) {
            return new RedirectResponse($return);
        }
    }
    // ... default redirect ...
}

The patch adds a validation step using a URL helper to ensure the redirect target is safe.

Exploitation & Lab Setup

Red Team

Exploit with Nuclei: The provided Nuclei template can be used to scan for vulnerable instances. It sends a GET request to /logout?return=http://oast.pro and checks for a Location header containing the attacker-controlled domain and a Set-Cookie header with flarum_session=.

id: CVE-2024-21641

info:
  name: Flarum < 1.8.5 - Open Redirect
  author: kking
  severity: medium
  description: |
    Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation.
  impact: |
    Unauthenticated attackers can redirect users to malicious phishing sites using the trusted domain of the Flarum installation.
  remediation: |
    Update Flarum to version 1.8.5 or later.
  reference:
    - https://github.com/flarum/framework/security/advisories/GHSA-733r-8xcp-w9mr
    - https://github.com/flarum/flarum-core/commit/ee8b3b4ad1413a2b0971fdd9e40f812d2a3a9d3a
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21641
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2024-21641
    cwe-id: CWE-601
    epss-score: 0.32766
    epss-percentile: 0.96899
    cpe: cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: flarum
    product: flarum
    fofa-query: header="flarum_session="
    zoomeye-query: app="Flarum"
  tags: cve,cve2024,flarum,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/logout?return=http://oast.pro"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro\/?(\/|[^.].*)?$'
          - "Set-Cookie: flarum_session="
        condition: and

      - type: status
        status:
          - 302

Manual Exploitation:

1. Identify a Flarum instance (e.g., https://forum.example.com).
2. Craft a malicious link: https://forum.example.com/logout?return=https://attacker.com/phishing.
3. Send the link to a victim (e.g., via email or social media).
4. When the victim clicks, they are redirected to the attacker's site.

Blue Team

Detection:

• Monitor web server logs for requests to /logout with a return parameter containing external URLs.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Honeypot:

• Deploy a fake Flarum instance and monitor for /logout?return= requests.
• Log all redirect attempts for analysis.

Indicators of Compromise (IOCs)

• URL Pattern: /logout?return=http:// or /logout?return=https:// (external domains)
• HTTP Response: 302 redirect with Location header pointing to an external domain
• Cookie: Set-Cookie: flarum_session= in the response
• Log Entries: GET /logout?return=http://... with status 302

Detection Engineering

YARA Rule

rule CVE_2024_21641_Flarum_Open_Redirect {
    meta:
        description = "Detects Flarum open redirect exploitation attempts"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-21641"
        severity = "medium"
    strings:
        $url_pattern = "/logout?return="
        $http_pattern = "HTTP/1.1 302"
        $location_pattern = "Location: http"
    condition:
        $url_pattern and $http_pattern and $location_pattern
}

Sigma Rule

title: Flarum Open Redirect Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-21641 in Flarum
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "/logout?return=http"
    condition: selection
falsepositives:
    - Legitimate redirects to external sites (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-21641 Flarum Open Redirect Attempt"; flow:to_server; content:"/logout?return="; http_uri; content:"http"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update Flarum to version 1.8.5 or later using Composer: composer update flarum/core --with-dependencies
• If immediate update is not possible, implement a web application firewall (WAF) rule to block requests to /logout with external return parameters.

Long-term:

• Enforce strict URL validation for all redirect parameters.
• Use a whitelist of allowed redirect domains.
• Conduct regular security audits of third-party extensions.

Workaround:

• Some extensions that modify the logout route may provide safe implementations. Review and update any custom extensions.

Valters IT

{/* [Security Hash: 3894F3352BAD1F0A38FE49DD] */}