CVE-2025-35059
📋 TL;DR
This vulnerability in Newforma Info Exchange (NIX) allows unauthenticated attackers to redirect users to arbitrary external websites via the 'nhl' parameter in the '/DownloadWeb/hyperlinkredirect.aspx' endpoint. This affects all organizations using vulnerable versions of NIX software, potentially enabling phishing attacks and credential theft.
💻 Affected Systems
- Newforma Info Exchange (NIX)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could redirect users to malicious sites that steal credentials, install malware, or conduct sophisticated phishing campaigns, potentially leading to full system compromise.
Likely Case
Most attackers would use this for phishing campaigns to steal user credentials or distribute malware through convincing redirects.
If Mitigated
With proper web application firewalls and user education about suspicious links, impact is limited to potential user confusion from unexpected redirects.
🎯 Exploit Status
Exploitation requires only crafting a URL with malicious redirect parameter; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Newforma vendor advisory for specific patched versions
Vendor Advisory: https://www.newforma.com/security-advisories
Restart Required: No
Instructions:
1. Check Newforma security advisory for patch details. 2. Apply the latest security update from Newforma. 3. Verify the '/DownloadWeb/hyperlinkredirect.aspx' endpoint no longer accepts unvalidated redirects.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock or monitor requests to the vulnerable endpoint with suspicious redirect parameters
WAF-specific configuration to block requests containing 'nhl' parameter with external URLs
URL Rewrite Rule
iisImplement IIS URL rewrite rules to restrict redirect functionality
<rule name="BlockNIXRedirect" stopProcessing="true">
<match url="hyperlinkredirect\.aspx" />
<conditions>
<add input="{QUERY_STRING}" pattern="nhl=.*" />
</conditions>
<action type="CustomResponse" statusCode="403" />
</rule>
🧯 If You Can't Patch
- Implement network segmentation to restrict access to NIX server from untrusted networks
- Deploy web application firewall with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Test by accessing http://[nix-server]/DownloadWeb/hyperlinkredirect.aspx?nhl=http://external-malicious-site.com and checking if redirect occursCheck Version:
Check NIX administration panel or consult Newforma documentation for version informationVerify Fix Applied:
Attempt the same test after patching; successful fix should block or sanitize the redirect📡 Detection & Monitoring
Log Indicators:
- HTTP requests to '/DownloadWeb/hyperlinkredirect.aspx' with 'nhl' parameter containing external domains
- Unusual redirect patterns in web server logs
Network Indicators:
- Outbound connections from NIX server to unexpected external domains following redirect requests
SIEM Query:
source="web_server" AND url="*hyperlinkredirect.aspx*" AND query_string="*nhl=*"