CVE-2025-64116
📋 TL;DR
This vulnerability allows attackers to redirect authenticated users to malicious external websites via an unvalidated redirect parameter on the login page. It affects all Movary users running versions before 0.69.0 who could be tricked into clicking specially crafted login links.
💻 Affected Systems
- Movary
📦 What is this software?
Movary by Leepeuker
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or install malware, leading to account compromise and potential credential reuse attacks.
Likely Case
Attackers could redirect users to malicious sites for phishing, ad fraud, or drive-by download attacks, potentially compromising user accounts.
If Mitigated
With proper URL validation, users would only be redirected to trusted internal pages, preventing external redirection attacks.
🎯 Exploit Status
Requires user interaction (clicking malicious link) and user authentication. Attackers need to craft malicious URLs with redirect parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.69.0
Vendor Advisory: https://github.com/leepeuker/movary/security/advisories/GHSA-7q72-x26x-7f8g
Restart Required: No
Instructions:
1. Backup your Movary installation and database. 2. Update to version 0.69.0 or later via git pull or package update. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to only allow redirects to trusted internal URLs
Modify login.php to validate redirect parameter against allowed domains
🧯 If You Can't Patch
- Implement web application firewall rules to block external redirects from login parameters
- Educate users about phishing risks and suspicious login links
🔍 How to Verify
Check if Vulnerable:
Check if login.php accepts 'redirect' parameter pointing to external domains like https://example.comCheck Version:
Check Movary version in admin panel or via git describe --tagsVerify Fix Applied:
Test that redirect parameter only accepts internal URLs after update📡 Detection & Monitoring
Log Indicators:
- HTTP requests to login.php with external URLs in redirect parameter
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound redirects from login page to external domains
SIEM Query:
source="web_logs" url="*login.php*" redirect="*http*" | where redirect contains external_domain