Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an Open Redirect (CWE-601) in GeoNetwork's post-login and post-logout redirect handling. The core issue lies in the insufficient validation of the redirectUrl parameter provided by the client. The application intended to only allow relative, in-application URLs for redirection after authentication or logout. However, the validation logic in multiple locations could be bypassed.
The analysis of the provided patches (commits 0d74f673dfc926bde935819ed34636d789b2fecd and cde9b6481a29e2473b7b74479b4e3fd6843bac4e) reveals that the vulnerable code existed in three main places:
jeeves.config.springutil.JeevesNodeAwareLogoutSuccessHandler.determineTargetUrl: This function handled redirects after logout. Its validation logic involved parsing the URL and checking its host, protocol, and port. This was flawed because it failed to account for protocol-relative URLs like //evil.example.com, which would pass the initial checks but be interpreted by the browser as a redirect to an external domain.
org.fao.geonet.kernel.security.keycloak.KeycloakAuthenticationProcessingFilter.successfulAuthentication: This filter handles redirects after a successful Keycloak SSO login. The validation logic relied on new URI(redirectUrl).isAbsolute(), which is not a robust way to prevent open redirects. This check can be bypassed by protocol-relative URLs, which are not considered 'absolute' by the java.net.URI class but are treated as such by browsers.
org.fao.geonet.kernel.security.openidconnect.GeonetworkOAuth2LoginAuthenticationFilter.successfulAuthentication: This filter is responsible for redirects after an OAuth2/OIDC login. It suffered from the same flaw as the Keycloak filter, using an inadequate !isAbsolute() check on the parsed URI.
The patch addresses these vulnerabilities by centralizing the redirect validation logic into a new utility class, org.fao.geonet.kernel.security.RedirectUtil. This class provides methods (isSafeRedirect and isRelativeRedirect) that perform more stringent checks, correctly identifying and rejecting unsafe redirect targets, including protocol-relative URLs and absolute URLs pointing to external domains. The vulnerable functions were then updated to use this new utility, ensuring that all post-login and post-logout redirects are handled safely.
jeeves.config.springutil.JeevesNodeAwareLogoutSuccessHandler.determineTargetUrlcore/src/main/java/jeeves/config/springutil/JeevesNodeAwareLogoutSuccessHandler.java
org.fao.geonet.kernel.security.keycloak.KeycloakAuthenticationProcessingFilter.successfulAuthenticationcore/src/main/java/org/fao/geonet/kernel/security/keycloak/KeycloakAuthenticationProcessingFilter.java
org.fao.geonet.kernel.security.openidconnect.GeonetworkOAuth2LoginAuthenticationFilter.successfulAuthenticationcore/src/main/java/org/fao/geonet/kernel/security/openidconnect/GeonetworkOAuth2LoginAuthenticationFilter.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.geonetwork-opensource:geonetwork | maven | >= 3.12.0, <= 3.12.12 | |
| org.geonetwork-opensource:geonetwork | maven | >= 4.0.0-alpha.1, <= 4.0.6 | |
| org.geonetwork-opensource:geonetwork | maven | >= 4.2.0, <= 4.2.15 | 4.2.16 |
| org.geonetwork-opensource:geonetwork | maven | >= 4.4.0, <= 4.4.10 | 4.4.11 |