CVE-2025-60935
📋 TL;DR
An open redirect vulnerability in Blitz Panel v1.17.0 allows attackers to redirect authenticated users to malicious domains via crafted URLs. This affects all users of the vulnerable version and could lead to phishing attacks or token theft after successful login.
💻 Affected Systems
- Blitz Panel
📦 What is this software?
Blitz by Returnfi
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal authentication tokens or credentials via phishing sites, leading to account compromise and potential lateral movement.
Likely Case
Users redirected to phishing sites that harvest credentials or install malware.
If Mitigated
Redirects blocked or users warned about external domains, preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction (clicking link) but is trivial to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Monitor GitHub repository for updates.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only allow relative URLs or trusted domains in next_url parameter.
Modify login endpoint code to validate next_url against whitelist
Remove Redirect Parameter
allDisable or remove the next_url parameter functionality entirely.
Modify login endpoint to ignore next_url parameter
🧯 If You Can't Patch
- Implement WAF rules to block malicious redirect patterns in login requests.
- Educate users about phishing risks and implement URL warning banners.
🔍 How to Verify
Check if Vulnerable:
Test login endpoint with next_url parameter set to external domain like https://evil.com.Check Version:
Check Blitz Panel version in admin interface or configuration files.Verify Fix Applied:
Verify redirects only occur to trusted/internal domains after implementing validation.📡 Detection & Monitoring
Log Indicators:
- Login requests with external domains in next_url parameter
- Unexpected redirects after authentication
Network Indicators:
- Outbound connections to suspicious domains immediately after login
SIEM Query:
source="web_logs" AND uri="/login" AND query_string="*next_url=*" AND NOT query_string="*next_url=/"