CVE-2025-71244

Executive Summary

CVE-2025-71244 is an open redirect vulnerability in SPIP, a popular content management system. The flaw exists in the login form when it is configured to operate in AJAX mode. An attacker can craft a malicious URL that, after a successful login, redirects the user to an arbitrary external site. This can be leveraged for phishing attacks, credential harvesting, or bypassing URL validation controls. The vulnerability affects SPIP versions before 4.4.5 and 4.3.9. No public exploit code is available, but the attack vector is straightforward and requires user interaction (clicking a link and logging in).

Supply Chain & Package Security

SPIP is a PHP-based CMS distributed via its official website and package repositories. The vulnerability is not in a third-party package but in the core login mechanism. Users should verify the integrity of their SPIP installation and ensure they are using official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction and specific configuration (AJAX login mode), but it can be used in targeted phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the SPIP login form when it is overridden to function in AJAX mode. In this mode, the login process is handled via asynchronous JavaScript requests. The redirect parameter (often redirect or url) is not properly validated. An attacker can craft a URL like:

https://vulnerable-spip-site.com/spip.php?action=login&redirect=https://evil.com

When a victim visits this URL and successfully logs in, SPIP redirects the browser to https://evil.com. This is a classic open redirect (CWE-601). The SPIP security screen does not mitigate this because the redirect occurs after authentication in the AJAX flow.

The vulnerable code likely looks like:

// Vulnerable: no validation of $redirect
$redirect = $_GET['redirect'];
// ... after login ...
header("Location: $redirect");

The patched code validates that the redirect URL is either a relative path or belongs to the same origin:

$redirect = $_GET['redirect'];
if (preg_match('#^https?://#', $redirect) && parse_url($redirect, PHP_URL_HOST) !== $_SERVER['HTTP_HOST']) {
    $redirect = 'spip.php'; // fallback to safe URL
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable SPIP instance (version < 4.4.5) with AJAX login enabled.
2. Craft Malicious URL: Create a link: http://target/spip.php?action=login&redirect=http://attacker-controlled.com/phishing
3. Phishing: Send the link to a victim via email or social engineering.
4. Execution: Victim clicks the link, logs in, and is redirected to the attacker's site.
5. Harvesting: The attacker's site can mimic the original site to steal credentials or session tokens.

Example URL:

http://target-spip-site.com/spip.php?action=login&redirect=http://evil.com/fake-login

Blue Team (Defense & Detection)

1. Monitor Logs: Look for login requests with suspicious redirect parameters pointing to external domains.
2. Web Application Firewall (WAF): Block requests where the redirect parameter contains an external URL.
3. User Education: Train users to verify URLs before clicking and to check the address bar after login.
4. Patch: Immediately upgrade to SPIP 4.4.5 or 4.3.9.

Indicators of Compromise (IOCs)

• URL Pattern: spip.php?action=login&redirect=http:// or https:// followed by an external domain.
• HTTP Referer: Unusual referer headers from external domains after login.
• Log Entries: Login success events followed by redirects to external URLs.
• Network Traffic: Outbound connections to known phishing or malicious domains after SPIP login.

Detection Engineering

YARA Rule

rule CVE_2025_71244_Open_Redirect {
    meta:
        description = "Detects SPIP open redirect attempts via login form"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-71244"
    strings:
        $s1 = "action=login" nocase
        $s2 = "redirect=" nocase
        $s3 = "http://" nocase
        $s4 = "https://" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: SPIP Open Redirect via AJAX Login
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SPIP login requests with external redirect parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'action=login'
            - 'redirect=http'
            - 'redirect=https'
    condition: selection
falsepositives:
    - Legitimate redirects to same domain (should be relative)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71244 SPIP Open Redirect Attempt"; flow:to_server; content:"action=login"; http_uri; content:"redirect="; http_uri; content:"http://"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to SPIP 4.4.5 or 4.3.9. These versions include proper validation of the redirect parameter.
2. Configuration Change: If upgrading is not possible, disable AJAX mode for the login form. Set $GLOBALS['ajax_login'] = false; in the SPIP configuration.
3. WAF Rule: Implement a WAF rule to block requests where the redirect parameter contains an external domain.
4. User Training: Educate users about phishing attacks that exploit open redirects.
5. Monitor: Continuously monitor logs for suspicious redirect patterns.

Valters IT
Securing Digital Frontiers