-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| miniflux.app/v2 | go | <= 2.2.14 | 2.2.15 |
Miggo AIRoot Cause AnalysisThe analysis of the security patch (commit 76df99f3a3db234cf6b312be5e771485213d03c7) clearly indicates that the vulnerability is located in the checkLogin function within the internal/ui/login_check.go file. The vulnerability is an Open Redirect, caused by improper validation of the redirect_url parameter. The original code used !parsedURL.IsAbs() to determine if a URL was relative and safe for redirection. However, this check fails to account for protocol-relative URLs like //example.com, which pass the !IsAbs() check but are treated as absolute URLs by browsers, thus redirecting the user to an external, potentially malicious, site. The patch replaces this flawed logic with a new, stricter function, urllib.IsRelativePath, which correctly identifies and disallows such URLs by checking if both the scheme and host are empty. The vulnerable function is handler.checkLogin as it is the entry point that handles the user-supplied redirect_url and performs the unsafe redirect.
handler.checkLogininternal/ui/login_check.go