CVE-2024-7902
📋 TL;DR
This vulnerability allows attackers to redirect users to malicious websites by manipulating the 'source' parameter in the PKP OJS login/signOut endpoint. It affects all PKP OJS installations up to version 3.4.0-6. The attack can be launched remotely without authentication.
💻 Affected Systems
- PKP Open Journal Systems (OJS)
📦 What is this software?
Open Journal Systems by Public Knowledge Project
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Attackers use the redirect for phishing campaigns targeting journal users, potentially stealing login credentials or session tokens.
If Mitigated
With proper web application firewalls and user education about suspicious URLs, impact is limited to failed phishing attempts.
🎯 Exploit Status
Exploit has been publicly disclosed and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Upgrade to a version beyond 3.4.0-6 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject or sanitize the 'source' parameter containing external domains.
Modify /login/signOut endpoint code to validate 'source' parameter against allowed domains
Web Application Firewall Rule
allBlock requests to /login/signOut with suspicious 'source' parameter values.
WAF rule: Block if request_uri contains '/login/signOut' and args contains 'source' with value matching '.*\\.example\\..*'
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict redirect destinations
- Monitor and block suspicious redirect patterns in web server logs
🔍 How to Verify
Check if Vulnerable:
Test by accessing /login/signOut?source=http://malicious.example.com and checking if redirect occursCheck Version:
Check OJS version in admin panel or via system information endpointVerify Fix Applied:
After implementing fixes, test that redirects to external domains are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- HTTP 302 redirects from /login/signOut to external domains
- Unusual 'source' parameter values in access logs
Network Indicators:
- Outbound connections to unexpected domains following OJS login/logout
SIEM Query:
source="web_server" AND uri="/login/signOut" AND (status=302 OR status=301) AND referer contains "source="