CVE-2024-49706
📋 TL;DR
This CVE describes an open redirect vulnerability in Internet Starter, a module of the SoftCOM iKSORIS system. Attackers can manipulate the 'target' parameter in POST requests to redirect users to malicious websites. Organizations using vulnerable versions of iKSORIS are affected.
💻 Affected Systems
- SoftCOM iKSORIS system with Internet Starter module
📦 What is this software?
Iksoris by Softcom.wroc
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Attackers use crafted links to redirect users to malicious sites for phishing or credential harvesting campaigns.
If Mitigated
With proper web filtering and user awareness, impact is limited to failed phishing attempts.
🎯 Exploit Status
Exploitation requires sending a POST request with a malicious base64-encoded URL parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 79.0
Vendor Advisory: https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
Restart Required: Yes
Instructions:
1. Download version 79.0 or later from the vendor. 2. Backup current installation. 3. Apply the update following vendor instructions. 4. Restart the iKSORIS service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject base64-encoded URLs in the target parameter.
Web Application Firewall Rule
allBlock requests containing base64-encoded URLs in POST parameters.
🧯 If You Can't Patch
- Implement strict URL validation at the network perimeter or WAF to block malicious redirects.
- Educate users to verify URLs before entering credentials and enable browser phishing protection.
🔍 How to Verify
Check if Vulnerable:
Test by sending a POST request with a base64-encoded external URL in the target parameter to vulnerable endpoints.Check Version:
Check the iKSORIS administration panel or software properties for version number.Verify Fix Applied:
After patching, attempt the same test; successful redirects should be blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- POST requests with base64-encoded strings in parameters
- Unusual redirect patterns in web server logs
Network Indicators:
- HTTP 302 redirects to external domains from iKSORIS endpoints
SIEM Query:
source="iKSORIS" AND (method="POST" AND url_decoded CONTAINS "target=" AND base64_string_detected)