CVE-2025-0970
📋 TL;DR
This vulnerability in Zenvia Movidesk allows attackers to redirect users to malicious websites by manipulating the ReturnUrl parameter in the login page. It affects all users of Movidesk versions up to 25.01.22. The attack can be launched remotely without authentication.
💻 Affected Systems
- Zenvia Movidesk
📦 What is this software?
Movidesk by Zenvia
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Attackers use the redirect for phishing campaigns to harvest user credentials or distribute malicious links.
If Mitigated
With proper user awareness training and URL filtering, the impact is limited to potential user confusion from unexpected redirects.
🎯 Exploit Status
Exploit has been publicly disclosed and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.01.22.245a473c54
Vendor Advisory: Not provided in CVE details
Restart Required: No
Instructions:
1. Upgrade Zenvia Movidesk to version 25.01.22.245a473c54 or later. 2. Verify the upgrade completed successfully. 3. Test the /Account/Login functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to only allow relative URLs or trusted domains in ReturnUrl parameter
Configuration depends on web server and application framework
WAF Rule
allDeploy web application firewall rules to block malicious redirect attempts
Add rule to detect and block suspicious ReturnUrl parameters containing external domains
🧯 If You Can't Patch
- Implement strict URL validation at the application level to only allow relative URLs in ReturnUrl parameter
- Deploy network monitoring to detect and block redirects to untrusted domains
🔍 How to Verify
Check if Vulnerable:
Test by accessing /Account/Login?ReturnUrl=https://malicious.example.com and checking if redirect occursCheck Version:
Check Movidesk admin panel or application version file for current versionVerify Fix Applied:
After patching, test the same URL and verify no redirect occurs or only relative URLs are accepted📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /Account/Login with external URLs in ReturnUrl parameter
- Unexpected redirect responses from login page
Network Indicators:
- Outbound connections to unexpected domains following login attempts
- Redirect chains involving untrusted domains
SIEM Query:
source="web_server" AND uri="/Account/Login" AND query_string="*ReturnUrl=*" | where query_string contains "http://" OR "https://"