CVE-2025-11190

Executive Summary

CVE-2025-11190 identifies an open redirection vulnerability in the Kiwire Captive Portal. The flaw exists in the login-url parameter, which does not properly validate or sanitize user-supplied URLs. An attacker can craft a malicious link that, when clicked by an authenticated or unauthenticated user, redirects them to an attacker-controlled website. This can be leveraged for phishing campaigns, credential harvesting, or malware distribution. The vulnerability has a CVSS v3.1 base score of 4.7 (Medium), with a vector emphasizing network attack vector, low attack complexity, and required user interaction. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary captive portal solution (Kiwire). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Changed (S:C) – The redirect can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Potential for limited information disclosure (e.g., phishing).
• Integrity Impact: Low (I:L) – The redirect can modify the user’s session or trust.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the vulnerability does not allow direct code execution, it enables social engineering attacks that can lead to credential theft or malware delivery.

Deep Dive & Mechanics

The Kiwire Captive Portal is a network gateway solution that intercepts unauthenticated users and presents a login page. The login-url parameter is used to specify the destination after successful authentication. The vulnerability arises because the application does not validate that the provided URL belongs to a trusted domain. An attacker can inject an arbitrary external URL, such as https://evil.com, into the login-url parameter.

Attack Flow:

1. The attacker crafts a URL: https://victim-captive-portal.com/login?login-url=https://evil.com
2. The attacker sends this link to a victim via email, SMS, or social media.
3. The victim clicks the link and is taken to the legitimate captive portal.
4. The portal processes the login-url parameter and, after any interaction (or even immediately), redirects the victim to https://evil.com.
5. The attacker’s site can then mimic the legitimate login page to steal credentials or serve malware.

Root Cause: Lack of input validation and whitelist-based URL filtering. The application should only allow redirects to internal or trusted domains.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code likely resembles:

// Vulnerable PHP example
$redirect_url = $_GET['login-url'];
header("Location: " . $redirect_url);
exit;

A patched version would implement a whitelist:

// Patched PHP example
$allowed_hosts = ['portal.kiwire.com', 'auth.kiwire.com'];
$redirect_url = $_GET['login-url'];
$parsed_url = parse_url($redirect_url);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    header("Location: " . $redirect_url);
} else {
    header("Location: /default-dashboard.php");
}
exit;

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Kiwire Captive Portal instance (e.g., in a lab environment).
• A publicly accessible attacker-controlled website (e.g., https://evil.com).

Exploit Steps:

1. Identify the captive portal URL (e.g., https://portal.kiwire.com/login).
2. Craft the malicious URL: https://portal.kiwire.com/login?login-url=https://evil.com
3. Encode the URL if necessary (e.g., https://portal.kiwire.com/login?login-url=https%3A%2F%2Fevil.com).
4. Distribute the link to victims via phishing email or social engineering.

Proof-of-Concept (No exploit code available):

# Simple curl test to verify redirection
curl -v "https://portal.kiwire.com/login?login-url=https://evil.com"
# Expected response: HTTP 302 with Location: https://evil.com

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual login-url parameters containing external domains.
• Use the Sigma rule below to detect suspicious redirects.

Defense:

• Implement strict URL whitelisting for the login-url parameter.
• Add server-side validation to reject non-internal URLs.
• Use Content Security Policy (CSP) headers to restrict allowed redirect destinations.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• URL Pattern: */login?login-url=* where the value is an external domain.
• Network Traffic: HTTP 302 responses with Location header pointing to an external domain.
• Log Entries: Web server logs showing login-url parameter with non-internal hosts.

Detection Engineering

YARA Rule

rule CVE_2025_11190_Kiwire_Open_Redirect {
    meta:
        description = "Detects open redirection attempts in Kiwire Captive Portal via login-url parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11190"
    strings:
        $param = "login-url="
        $http_redirect = /HTTP\/1\.[01] 302/
        $external_host = /https?:\/\/[^\/]+\.[^\/]+/
    condition:
        $param and $http_redirect and $external_host
}

Sigma Rule

title: Kiwire Captive Portal Open Redirect via login-url
id: 8a3f7c2e-9b1d-4e5f-8c7a-2d3e4f5a6b7c
status: experimental
description: Detects HTTP requests with suspicious login-url parameter indicating open redirect
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "login-url="
        sc-status: 302
    filter:
        cs-uri-query|contains:
            - "login-url=https://portal.kiwire.com"
            - "login-url=https://auth.kiwire.com"
    condition: selection and not filter
falsepositives:
    - Legitimate internal redirects (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11190 Kiwire Captive Portal Open Redirect"; flow:to_server; content:"login-url="; http_uri; content:"302"; http_server_body; pcre:"/login-url=https?:\/\/[^\/]+\.[^\/]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable open redirects: If possible, modify the application to only allow redirects to a predefined list of internal URLs.
2. Input validation: Implement strict validation of the login-url parameter, rejecting any URL that does not match a whitelist.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests with login-url pointing to external domains.

Long-term Fix:

• The vendor (Kiwire) should release a patch that implements URL whitelisting and proper input sanitization.
• Conduct a security audit of the captive portal for similar vulnerabilities.

Workaround:

• If patching is not possible, consider disabling the login-url parameter entirely or hardcoding the redirect destination.

Valters IT – Securing digital frontiers, one CVE at a time.