CVE-2025-4513

Executive Summary

CVE-2025-4513 is a publicly disclosed open redirect vulnerability in the Catalyst User Key Authentication Plugin version 20220819 for Moodle. The flaw resides in the /auth/userkey/logout.php file, where the return parameter is not properly validated, allowing an attacker to redirect users to arbitrary external URLs. This can be exploited for phishing campaigns, credential harvesting, or bypassing security controls. The vendor (Catalyst) was contacted but did not respond, and no official patch is available at this time. The vulnerability has a CVSS score of 0.0 due to incomplete scoring data, but based on the vector, it is a low-severity issue with a medium attack complexity.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Moodle plugin (auth_userkey) distributed via the Moodle plugins directory. Users should verify the integrity of their plugin installation and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Possible redirection to malicious sites.
• Availability (A): None (N) – No service disruption.

Threat Level: Low. The vulnerability requires user interaction and does not directly compromise system integrity or confidentiality. However, it can be chained with other attacks (e.g., phishing) to increase impact.

Deep Dive & Mechanics

The vulnerability is an open redirect (CWE-601) in the logout.php script of the Catalyst User Key Authentication plugin. The return parameter is used to redirect users after logout, but it is not sanitized or validated against a whitelist of allowed domains. An attacker can craft a URL like:

https://victim-moodle.com/auth/userkey/logout.php?return=https://evil.com

When a user clicks this link, they are logged out and then redirected to https://evil.com. This can be used to:

• Phish credentials by mimicking the Moodle login page.
• Deliver malware via drive-by download.
• Bypass URL-based security filters.

The exploit has been publicly disclosed, increasing the risk of active exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (auth/userkey/logout.php):

<?php
require_once('../../config.php');
$return = optional_param('return', '', PARAM_URL);
// No validation of $return
redirect($return);
?>

Patched Code (Hypothetical):

<?php
require_once('../../config.php');
$return = optional_param('return', '', PARAM_URL);
$allowed_hosts = array('moodle.org', 'example.com'); // Whitelist
$parsed_url = parse_url($return);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    redirect($return);
} else {
    redirect($CFG->wwwroot); // Default redirect
}
?>

The patch adds a whitelist check to ensure the redirect target is a trusted domain.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Moodle instance with Catalyst User Key Authentication plugin 20220819.
• A controlled external server (e.g., evil.com) to receive redirected traffic.

Exploit Steps:

1. Craft a malicious URL:

   https://victim-moodle.com/auth/userkey/logout.php?return=https://evil.com/phishing.html
   

2. Distribute the link via email, social media, or other channels.
3. When a victim clicks the link, they are redirected to evil.com, where a fake login page can capture credentials.

Example Exploit (Python):

import requests

target = "https://victim-moodle.com/auth/userkey/logout.php"
params = {"return": "https://evil.com"}
response = requests.get(target, params=params, allow_redirects=False)
print(f"Redirect Location: {response.headers.get('Location')}")

Blue Team

Detection:

• Monitor web server logs for requests to /auth/userkey/logout.php with suspicious return parameters.
• Use the Sigma rule below to detect anomalous redirects.

Mitigation:

• Apply the hypothetical patch above.
• Implement a Web Application Firewall (WAF) rule to block requests with external redirect targets.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• URL Pattern: /auth/userkey/logout.php?return=*
• Suspicious Redirect Targets: Any external domain not in the whitelist.
• Log Entries: HTTP 302 responses from logout.php with Location header pointing to external sites.

Detection Engineering

YARA Rule

rule CVE_2025_4513_Open_Redirect {
    meta:
        description = "Detects open redirect in Catalyst User Key Authentication plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4513"
    strings:
        $s1 = "/auth/userkey/logout.php" ascii nocase
        $s2 = "return=" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-4513 Open Redirect Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects open redirect attempts via /auth/userkey/logout.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/auth/userkey/logout.php?return="
    condition: selection
falsepositives:
    - Legitimate redirects to trusted domains
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4513 Open Redirect Attempt"; flow:to_server; content:"/auth/userkey/logout.php"; http_uri; content:"return="; http_uri; pcre:"/return=https?:\/\/(?!moodle\.org|example\.com)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the plugin if not essential.
2. Short-term: Apply the hypothetical patch by adding a redirect whitelist.
3. Long-term: Monitor the Catalyst vendor for an official patch. If none is provided, consider replacing the plugin with an alternative.
4. Compensating Controls: Use a WAF to block external redirects, enforce Content Security Policy (CSP) headers, and conduct regular security audits.

Valters IT
Securing Digital Frontiers