{"id":"GHSA-564j-v29w-rqr6","summary":"Khoj Open Redirect Vulnerability in Login Page","details":"### Summary\nAn attacker can use the `next` parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking `app.khoj.dev` url.\nFor example, `https://app.khoj.dev/login?next=//example.com` will redirect to the https://example.com page.\n\n### Details\nThe problem seems to be in this method: https://github.com/khoj-ai/khoj/blob/2667ef45449eb408ce1d7c393be04845be31e15f/src/khoj/routers/auth.py#L95\n\n### PoC\nOpen the `https://app.khoj.dev/login?next=//example.com` url in a Gecko-based browser (Firefox).\n\n### Impact\nThe impact is low, and this could only be used in phishing attempts, but it's still a problem nonetheless.","modified":"2024-12-06T05:29:45.728140Z","published":"2024-07-08T14:57:43Z","database_specific":{"github_reviewed_at":"2024-07-08T14:57:43Z","nvd_published_at":null,"cwe_ids":["CWE-601"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/khoj-ai/khoj/security/advisories/GHSA-564j-v29w-rqr6"},{"type":"WEB","url":"https://github.com/khoj-ai/khoj/commit/4daf16e5f916641304e11d56a6071ad365c21a18"},{"type":"PACKAGE","url":"https://github.com/khoj-ai/khoj"},{"type":"WEB","url":"https://github.com/khoj-ai/khoj/blob/2667ef45449eb408ce1d7c393be04845be31e15f/src/khoj/routers/auth.py#L95"}],"affected":[{"package":{"name":"khoj-assistant","ecosystem":"PyPI","purl":"pkg:pypi/khoj-assistant"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0"}]}],"versions":["0.1.0","0.1.10","0.1.10a1663015308","0.1.10a1663120862","0.1.10a1665241166","0.1.10a1666175593","0.1.10a1666178687","0.1.10a1666206255","0.1.10a1666711029","0.1.10a1669992668","0.1.2","0.1.3","0.1.4","0.1.5","0.1.5a1659579052","0.1.5a1659579898","0.1.5a1659613793","0.1.5a1659652122","0.1.5a1659657577","0.1.5a1659660875","0.1.5a1659664552","0.1.5a1659664585","0.1.5a1659664749","0.1.5a1659666776","0.1.5a1659669671","0.1.5a1659721951","0.1.5a1659788475","0.1.5a1659793270","0.1.5a1659877456","0.1.5a1659889097","0.1.5a1660068819","0.1.5a1660147746","0.1.5a1660251099","0.1.5a1660261123","0.1.5a1660267388","0.1.5a1660338517","0.1.5a1660342051","0.1.5a1660345761","0.1.5a1660355478","0.1.5a1660356325","0.1.5a1660416136","0.1.5a1660451425","0.1.5a1660533836","0.1.5a1660535823","0.1.5a1660578371","0.1.5a1660604608","0.1.5a1660658481","0.1.6","0.1.6a1660660802","0.1.6a1660756592","0.1.6a1660930714","0.1.6a1660931515","0.1.6a1660932216","0.1.6a1661037490","0.1.6a1661037642","0.1.6a1661101510","0.1.6a1661339444","0.1.6a1662201038","0.1.6a1662211330","0.1.6a1662299824","0.1.6a1662391888","0.1.6a1662495600","0.1.7","0.1.7a1662547355","0.1.8","0.1.8a1662551605","0.1.8a1662698531","0.1.9","0.1.9a1662700774","0.1.9a1662813812","0.1.9a1662817497","0.1.9a1662836076","0.1.9a1662845978","0.1.9a1662904061","0.1.9a1662906981","0.1.9a1662964872","0.1.9a1662970887","0.1.9a1662992094","0.10.0","0.10.1","0.10.1.dev13","0.10.1.dev14","0.10.1.dev15","0.10.1.dev18","0.10.1.dev48","0.10.1.dev50","0.10.1.dev7","0.10.2.dev1","0.10.2.dev12","0.10.2.dev13","0.10.2.dev20","0.10.2.dev21","0.10.2.dev22","0.10.2.dev23","0.10.2.dev24","0.10.2.dev25","0.10.2.dev3","0.10.2.dev4","0.10.2.dev7","0.11.0","0.11.1","0.11.1.dev1","0.11.1.dev3","0.11.1.dev4","0.11.1.dev6","0.11.2","0.11.2.dev1","0.11.2.dev12","0.11.2.dev16","0.11.2.dev2","0.11.2.dev3","0.11.2.dev4","0.11.2.dev5","0.11.2.dev6","0.11.3","0.11.3.dev3","0.11.4","0.11.4.dev1","0.11.5.dev1","0.11.5.dev10","0.11.5.dev11","0.11.5.dev13","0.11.5.dev17","0.11.5.dev2","0.11.5.dev3","0.11.5.dev4","0.11.5.dev5","0.11.5.dev6","0.11.5.dev7","0.11.5.dev8","0.12.0","0.12.1","0.12.1.dev5","0.12.2","0.12.3","0.12.3.dev1","0.12.4.dev10","0.12.4.dev11","0.12.4.dev12","0.12.4.dev25","0.12.4.dev3","0.12.4.dev4","0.12.4.dev51","0.12.4.dev52","0.12.4.dev53","0.12.4.dev54","0.12.4.dev59","0.12.4.dev6","0.12.4.dev61","0.12.4.dev63","0.12.4.dev64","0.12.4.dev8","0.13.0","0.13.1.dev3","0.13.1.dev4","0.13.1.dev5","0.13.1.dev6","0.14.0","0.14.1.dev194","0.14.1.dev195","0.14.1.dev197","0.14.1.dev198","0.14.1.dev199","0.14.1.dev202","0.14.1.dev208","0.14.1.dev217","0.2.0","0.2.0a1670004224","0.2.0a1670086074","0.2.1","0.2.1a1670156230","0.2.1a1671069345","0.2.1a1671486327","0.2.1a1671545294","0.2.1a1671589932","0.2.1a1671833561","0.2.1a1672079113","0.2.1a1672619971","0.2.1a1672794472","0.2.1a1672857683","0.2.1a1672873455","0.2.1a1672874018","0.2.1a1672874118","0.2.1a1672876158","0.2.2a1672934486","0.2.2a1672935943","0.2.2a1672944082","0.2.2a1673187153","0.2.2a1673202669","0.2.2a1673235659","0.2.2a1673239238","0.2.2a1673305013","0.2.2a1673403763","0.2.2a1673404805","0.2.2a1673467444","0.2.2a1673467504","0.2.2a1673468671","0.2.2a1673481452","0.2.2a1673500169","0.2.2a1673500581","0.2.2a1673571996","0.2.2a1673661864","0.2.2a1673801646","0.2.2a1673801946","0.2.2a1673802220","0.2.2a1673802341","0.2.2a1673802657","0.2.2a1673802663","0.2.2a1673802698","0.2.2a1673920925","0.2.2a1673975093","0.2.2a1674011538","0.2.2a1674012449","0.2.2a1674108822","0.2.2a1674170668","0.2.2a1674265599","0.2.2a1674321690","0.2.2a1674420734","0.2.2a1674421302","0.2.2a1674421412","0.2.2a1674421606","0.2.5","0.2.5a1674422494","0.2.6","0.2.6a1674424130","0.2.6a1674517361","0.2.6a1674518115","0.2.6a1674770213","0.2.6a1674771400","0.2.6a1674860783","0.2.6a1675657620","0.2.6a1675728796","0.2.6a1675736303","0.2.6a1675745337","0.2.6a1675748643","0.3.0","0.3.0a1675901048","0.3.0a1676089339","0.3.0a1676209086","0.3.0a1676222845","0.3.0a1676245372","0.3.0a1676341220","0.3.0a1676393166","0.3.0a1676404462","0.3.0a1676413694","0.3.0a1676434280","0.3.0a1676434937","0.3.0a1676499757","0.3.0a1676536889","0.3.0a1676539432","0.3.0a1676540226","0.3.0a1676662834","0.3.0a1676667214","0.3.0a1676667840","0.3.0a1676668613","0.3.0a1676672238","0.3.1.dev21","0.3.1.dev24","0.3.1.dev26","0.3.1.dev27","0.3.1.dev28","0.3.1.dev30","0.4.0","0.4.1.dev23","0.4.1.dev24","0.4.1.dev34","0.4.1.dev49","0.4.1.dev71","0.4.1.dev73","0.4.1.dev74","0.4.1.dev94","0.5.0","0.5.1.dev20","0.6.0","0.6.1","0.6.1.dev3","0.6.1.dev5","0.6.2","0.6.2.dev17","0.6.2.dev18","0.6.2.dev20","0.6.2.dev29","0.6.2.dev31","0.6.2.dev6","0.6.3.dev104","0.6.3.dev127","0.6.3.dev130","0.6.3.dev141","0.6.3.dev142","0.6.3.dev143","0.6.3.dev146","0.6.3.dev150","0.6.3.dev151","0.6.3.dev152","0.6.3.dev153","0.6.3.dev154","0.6.3.dev20","0.6.3.dev23","0.6.3.dev26","0.6.3.dev29","0.6.3.dev3","0.6.3.dev39","0.6.3.dev45","0.6.3.dev53","0.6.3.dev64","0.6.3.dev65","0.6.3.dev74","0.6.3.dev75","0.6.3.dev76","0.6.3.dev78","0.6.3.dev79","0.6.3.dev80","0.6.3.dev81","0.6.3.dev88","0.6.3.dev89","0.6.3.dev90","0.6.3.dev92","0.6.3.dev93","0.6.3.dev96","0.6.3.dev97","0.6.3.dev98","0.7.0","0.7.1","0.7.1.dev10","0.7.1.dev12","0.7.1.dev14","0.7.1.dev15","0.7.1.dev23","0.7.1.dev30","0.7.1.dev31","0.7.1.dev32","0.7.1.dev33","0.7.2.dev1","0.7.2.dev2","0.7.2.dev20","0.7.2.dev22","0.7.2.dev23","0.7.2.dev26","0.7.2.dev3","0.7.2.dev30","0.7.2.dev31","0.7.2.dev34","0.7.2.dev39","0.7.2.dev4","0.7.2.dev42","0.7.2.dev43","0.7.2.dev44","0.7.2.dev45","0.7.2.dev46","0.7.2.dev49","0.7.2.dev51","0.7.2.dev52","0.8.0","0.8.1","0.8.1.dev1","0.8.2","0.8.3.dev1","0.8.3.dev10","0.8.3.dev12","0.8.3.dev16","0.8.3.dev18","0.8.3.dev19","0.8.3.dev20","0.8.3.dev21","0.8.3.dev38","0.8.3.dev4","0.8.3.dev42","0.8.3.dev48","0.8.3.dev8","0.9.0","0.9.1.dev17","0.9.1.dev18","0.9.1.dev24","0.9.1.dev25","0.9.1.dev3","0.9.1.dev30","0.9.1.dev34","0.9.1.dev35","0.9.1.dev7","0.9.1.dev8","1.0.0","1.0.1","1.0.1.dev16","1.0.1.dev27","1.0.1.dev30","1.0.1.dev31","1.0.1.dev32","1.0.1.dev34","1.0.1.dev43","1.0.1.dev45","1.0.1.dev7","1.0.2.dev27","1.0.2.dev28","1.0.2.dev37","1.0.2.dev58","1.0.2.dev60","1.0.2.dev78","1.0.2.dev79","1.0.2.dev81","1.0.2.dev82","1.0.2.dev86","1.0.2.dev92","1.0.2.dev94","1.1.0","1.1.1.dev23","1.1.1.dev27","1.1.1.dev31","1.1.1.dev32","1.1.1.dev37","1.1.1.dev38","1.1.1.dev39","1.1.1.dev40","1.1.1.dev41","1.1.1.dev5","1.1.1.dev51","1.1.1.dev52","1.1.1.dev6","1.1.1.dev7","1.10.0","1.10.1","1.10.1.dev1","1.10.2","1.10.2.dev1","1.10.2.dev2","1.10.3.dev1","1.10.3.dev23","1.10.3.dev24","1.10.3.dev25","1.10.3.dev26","1.10.3.dev27","1.10.3.dev28","1.10.3.dev29","1.10.3.dev30","1.10.3.dev31","1.10.3.dev32","1.10.3.dev33","1.10.3.dev34","1.10.3.dev4","1.10.3.dev40","1.10.3.dev43","1.10.3.dev44","1.10.3.dev45","1.10.3.dev47","1.10.3.dev49","1.10.3.dev50","1.10.3.dev51","1.10.3.dev52","1.10.3.dev57","1.10.3.dev6","1.10.3.dev62","1.10.3.dev66","1.10.3.dev7","1.11.0","1.11.1","1.11.1.dev2","1.11.1.dev4","1.11.1.dev5","1.11.2","1.11.2.dev2","1.11.2.dev3","1.11.2.dev4","1.11.2.dev5","1.11.2.dev6","1.11.3.dev1","1.11.3.dev44","1.11.3.dev52","1.12.0","1.12.1","1.12.1.dev1","1.12.1.dev10","1.12.1.dev11","1.12.1.dev14","1.12.1.dev15","1.12.1.dev16","1.12.1.dev17","1.12.1.dev18","1.12.1.dev19","1.12.1.dev2","1.12.1.dev20","1.12.1.dev21","1.12.1.dev22","1.12.1.dev23","1.12.1.dev25","1.12.1.dev26","1.12.1.dev27","1.12.1.dev28","1.12.1.dev3","1.12.1.dev30","1.12.1.dev31","1.12.1.dev34","1.12.1.dev35","1.12.1.dev36","1.12.1.dev39","1.12.1.dev4","1.12.1.dev40","1.12.1.dev41","1.12.1.dev5","1.12.1.dev6","1.12.1.dev7","1.12.1.dev8","1.12.1.dev9","1.12.2.dev10","1.12.2.dev11","1.12.2.dev13","1.12.2.dev15","1.12.2.dev16","1.12.2.dev17","1.12.2.dev18","1.12.2.dev19","1.12.2.dev2","1.12.2.dev20","1.12.2.dev21","1.12.2.dev22","1.12.2.dev23","1.12.2.dev24","1.12.2.dev25","1.12.2.dev3","1.12.2.dev4","1.12.2.dev49","1.12.2.dev5","1.12.2.dev50","1.12.2.dev53","1.12.2.dev54","1.12.2.dev55","1.12.2.dev59","1.12.2.dev61","1.12.2.dev62","1.12.2.dev64","1.12.2.dev65","1.12.2.dev68","1.13.0","1.13.1.dev1","1.13.1.dev13","1.13.1.dev14","1.13.1.dev15","1.13.1.dev16","1.13.1.dev17","1.13.1.dev19","1.13.1.dev2","1.13.1.dev20","1.13.1.dev21","1.13.1.dev26","1.13.1.dev27","1.13.1.dev28","1.13.1.dev29","1.13.1.dev3","1.13.1.dev30","1.13.1.dev31","1.13.1.dev34","1.13.1.dev51","1.13.1.dev52","1.13.1.dev53","1.13.1.dev64","1.2.0","1.2.1","1.2.1.dev20","1.2.1.dev21","1.2.1.dev22","1.2.1.dev26","1.2.1.dev27","1.2.1.dev4","1.2.2.dev16","1.2.2.dev21","1.2.2.dev3","1.2.2.dev32","1.2.2.dev33","1.2.2.dev43","1.2.2.dev45","1.2.2.dev50","1.3.0","1.3.1.dev1","1.3.1.dev16","1.3.1.dev17","1.3.1.dev18","1.3.1.dev2","1.3.1.dev3","1.3.1.dev4","1.4.0","1.4.1.dev1","1.4.1.dev10","1.4.1.dev11","1.4.1.dev12","1.4.1.dev13","1.4.1.dev15","1.4.1.dev2","1.4.1.dev3","1.4.1.dev4","1.4.1.dev5","1.4.1.dev8","1.4.1.dev9","1.5.0","1.5.1","1.5.1.dev1","1.5.1.dev12","1.5.1.dev17","1.5.1.dev2","1.5.1.dev4","1.5.1.dev6","1.5.2.dev14","1.5.2.dev15","1.5.2.dev16","1.5.2.dev2","1.5.2.dev3","1.5.2.dev4","1.5.2.dev6","1.5.2.dev7","1.6.0","1.6.1","1.6.1.dev15","1.6.1.dev16","1.6.1.dev2","1.6.1.dev21","1.6.1.dev23","1.6.1.dev27","1.6.1.dev3","1.6.1.dev31","1.6.1.dev32","1.6.2","1.6.2.dev1","1.6.2.dev10","1.6.2.dev12","1.6.2.dev15","1.6.2.dev17","1.6.2.dev19","1.6.2.dev21","1.6.2.dev25","1.6.2.dev31","1.6.2.dev33","1.6.2.dev4","1.6.2.dev44","1.6.2.dev5","1.6.2.dev6","1.6.2.dev7","1.6.2.dev8","1.6.2.dev9","1.7.0","1.7.1.dev10","1.7.1.dev12","1.7.1.dev2","1.7.1.dev44","1.7.1.dev46","1.7.1.dev47","1.7.1.dev48","1.7.1.dev9","1.8.0","1.8.1.dev11","1.8.1.dev14","1.8.1.dev15","1.8.1.dev48","1.8.1.dev49","1.8.1.dev50","1.8.1.dev51","1.8.1.dev52","1.8.1.dev53","1.8.1.dev54","1.8.1.dev56","1.8.1.dev58","1.8.1.dev60","1.8.1.dev62","1.8.1.dev63","1.9.0","1.9.1.dev1","1.9.1.dev26","1.9.1.dev27","1.9.1.dev29","1.9.1.dev3","1.9.1.dev30","1.9.1.dev31","1.9.1.dev32","1.9.1.dev33","1.9.1.dev34","1.9.1.dev35","1.9.1.dev36","1.9.1.dev38","1.9.1.dev5","1.9.1.dev56","1.9.1.dev57","1.9.1.dev58","1.9.1.dev59","1.9.1.dev60","1.9.1.dev61","1.9.1.dev63","1.9.1.dev65","1.9.1.dev74","1.9.1.dev8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-564j-v29w-rqr6/GHSA-564j-v29w-rqr6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}]}