CVE-2025-7949

Executive Summary

CVE-2025-7949 is a publicly disclosed open redirect vulnerability in Sanluan PublicCMS up to version 5.202506.a. The flaw resides in the preview.html template file, where the url parameter is not properly validated, allowing an attacker to redirect users to arbitrary external domains. With a CVSS score of 3.5 (Low), the vulnerability requires user interaction but can be exploited remotely without authentication. A patch is available and recommended for immediate application.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a direct code vulnerability in the PublicCMS Java application.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click a crafted link.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Redirect can lead to phishing or credential theft.
• Availability Impact: None (A:N)

Threat Level: Low. The open redirect is not a direct code execution or data breach, but it can be weaponized for phishing campaigns, malware distribution, or bypassing URL-based security controls.

Deep Dive & Mechanics

The vulnerability is located in the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The url parameter is accepted and used to construct a redirect response without proper validation or sanitization. An attacker can craft a link like:

https://victim.com/admin/cmsDiy/preview.html?url=https://evil.com

When a user clicks this link, the application performs an HTTP redirect to https://evil.com. The lack of a whitelist or origin check allows redirection to any external domain.

Root Cause: The application does not validate that the url parameter points to an internal or trusted resource. It directly uses the user-supplied value in a redirect response (e.g., Location header or JavaScript window.location).

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

// In preview.html controller or handler
String redirectUrl = request.getParameter("url");
response.sendRedirect(redirectUrl);

Patched Code (conceptual):

String redirectUrl = request.getParameter("url");
if (redirectUrl != null && (redirectUrl.startsWith("/") || redirectUrl.startsWith(request.getContextPath()))) {
    response.sendRedirect(redirectUrl);
} else {
    // Redirect to a safe default or show error
    response.sendRedirect("/");
}

The patch (commits c1e79f124e3f4c458315d908ed7dee06f9f12a76 and f1af17af004ca9345c6fe4d5936d87d008d26e75) adds validation to ensure the redirect URL is relative or points to the same origin, preventing open redirects.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of PublicCMS (<= 5.202506.a).
• A controlled external server (e.g., evil.com) to receive redirected traffic.

Exploit Steps:

1. Craft a malicious URL:

   https://victim.com/admin/cmsDiy/preview.html?url=https://evil.com
   

2. Send the link to a victim via email, social media, or other channels.
3. When the victim clicks, they are redirected to evil.com, which can host a phishing page or malware.

Example Phishing Payload:

https://victim.com/admin/cmsDiy/preview.html?url=https://evil.com/login?redirect=https://victim.com

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /admin/cmsDiy/preview.html with a url parameter pointing to external domains.
• Look for unusual referrer headers or patterns of repeated redirects.

Mitigation:

• Apply the patch immediately.
• Implement a web application firewall (WAF) rule to block requests where the url parameter does not start with / or the application's base path.
• Educate users to verify URLs before clicking.

Indicators of Compromise (IOCs)

• URL Pattern: */admin/cmsDiy/preview.html?url=*
• Log Entry Example:

  GET /admin/cmsDiy/preview.html?url=https://evil.com HTTP/1.1
  Host: victim.com
  

• Redirect Response: HTTP 302 with Location: https://evil.com
• Network Traffic: Outbound connections to untrusted domains shortly after a request to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_7949_Open_Redirect {
    meta:
        description = "Detects open redirect attempts targeting PublicCMS preview.html"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7949"
    strings:
        $url_param = "url=" nocase
        $vuln_path = "/admin/cmsDiy/preview.html" nocase
        $http_get = "GET" nocase
    condition:
        $http_get at 0 and $vuln_path and $url_param
}

Sigma Rule

title: PublicCMS Open Redirect Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects HTTP requests to PublicCMS preview.html with an external redirect URL
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/cmsDiy/preview.html'
        cs-uri-query|contains: 'url=http'
    condition: selection
falsepositives:
    - Legitimate internal redirects (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7949 PublicCMS Open Redirect"; flow:to_server,established; content:"GET"; http_method; content:"/admin/cmsDiy/preview.html"; http_uri; content:"url="; http_uri; pcre:"/url=https?:\/\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patch: Update PublicCMS to a version that includes the fix (commits c1e79f124e3f4c458315d908ed7dee06f9f12a76 / f1af17af004ca9345c6fe4d5936d87d008d26e75).
2. WAF Rule: Block requests to /admin/cmsDiy/preview.html where the url parameter contains an external domain (e.g., http:// or https:// not starting with the application's base path).
3. Input Validation: Ensure all redirect parameters are validated against a whitelist of allowed URLs.
4. User Awareness: Train users to recognize phishing attempts that leverage open redirects.
5. Monitor Logs: Regularly review web server logs for suspicious redirect patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert