Description

On Login Page, There Is A “from=” parameter in URL which is vulnerable to open redirect and which can be escalated to reflected XSS.

Proof of Concept

1. Install Keystone 6 On Your System.
2. Go To http://localhost:3000/signin?from=http://evil.com And Login And You’ll Be Redirected To evil.com.
3. Go To http://localhost:3000/signin?from=javascript:alert(document.domain) And Login And After Login, You’ll See Two Reflected XSS Pop Ups.

Impact

This vulnerability is capable of making users to redirect to any malicious website using open redirect and reflected XSS can help the attacker to fetch cookies and also for phishing.