CVE-2025-47789
📋 TL;DR
This is an open redirect vulnerability in Horilla HRMS that allows attackers to craft URLs that redirect users to external malicious domains after login. Attackers can use this to create convincing phishing pages that impersonate Horilla. All users of Horilla HRMS versions up to 1.3 are affected.
💻 Affected Systems
- Horilla HRMS
📦 What is this software?
Horilla by Horilla
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to sophisticated phishing sites that steal credentials, leading to full account compromise and potential data breaches.
Likely Case
Attackers create convincing phishing pages that harvest user credentials, leading to unauthorized access to HR systems.
If Mitigated
Users are redirected to suspicious external domains but recognize the phishing attempt before entering credentials.
🎯 Exploit Status
Exploitation requires user interaction (clicking a crafted link) but is technically simple to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Post-commit 1c72404df6888bb23af73c767fdaee5e6679ebd6
Vendor Advisory: https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468
Restart Required: Yes
Instructions:
1. Update Horilla to the latest version after commit 1c72404df6888bb23af73c767fdaee5e6679ebd6. 2. Restart the Horilla application. 3. Verify the fix by testing URL redirection.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject URLs containing external domains in redirect parameters.
# Add validation logic in your application code to check redirect URLs
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests with external domains in redirect parameters.
- Educate users about phishing risks and train them to verify URLs before entering credentials.
🔍 How to Verify
Check if Vulnerable:
Test by creating a URL with an external redirect parameter and checking if it redirects after login.Check Version:
Check Horilla version in admin panel or via application configuration files.Verify Fix Applied:
After patching, test the same URL to confirm it no longer redirects to external domains.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in application logs
- Multiple failed login attempts followed by redirects to external domains
Network Indicators:
- HTTP 302 redirects to external domains from Horilla login endpoints
SIEM Query:
source="horilla_logs" AND (url="*redirect=*http*" OR url="*redirect=*https*")