{"id":"GHSA-w228-rfpx-fhm4","summary":"cg vulnerable to an Open Redirect Vulnerability on Referer Header","details":"### Summary\n\nA vulnerability has been discovered in the handling of the referrer header in the application, which could allow an attacker to conduct open redirects. The issue arises from improper validation of the referrer header in certain conditions. By manipulating the referrer header, an attacker could potentially redirect users to malicious websites, phishing pages, or other dangerous destinations.\n\n### PoC\n\nIf you change the referer header, you will be redirected to that domain without verifying.\n\nhttps://github.com/Clinical-Genomics/cg/blob/master/cg/server/invoices/views.py#L173\n\n### Impact\n\nAn attacker exploiting this vulnerability could trick users into visiting malicious websites or disclose sensitive information by redirecting them to unintended destinations. This could lead to various attacks including phishing, malware distribution, or further exploitation of other vulnerabilities.","modified":"2024-12-06T05:43:58.698245Z","published":"2024-04-23T16:21:22Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-601"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-04-23T16:21:22Z"},"references":[{"type":"WEB","url":"https://github.com/Clinical-Genomics/cg/security/advisories/GHSA-w228-rfpx-fhm4"},{"type":"WEB","url":"https://github.com/Clinical-Genomics/cg/commit/96e6a968a5a3639cc40ad251ad65952e4f38dd25"},{"type":"PACKAGE","url":"https://github.com/Clinical-Genomics/cg"},{"type":"WEB","url":"https://github.com/Clinical-Genomics/cg/blob/master/cg/server/invoices/views.py#L173"}],"affected":[{"package":{"name":"cg","ecosystem":"PyPI","purl":"pkg:pypi/cg"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.12"}]}],"versions":["0.9.0","0.9.1","1.0.0","1.0.0b2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.2.0","12.3.0","12.3.1","12.3.2","12.3.3","12.3.4","12.3.5","12.3.6","12.4.0","12.5.0","12.6.0","12.7.0","12.7.1","13.0.0","13.1.0","13.10.0","13.10.1","13.11.0","13.12.0","13.12.1","13.13.0","13.14.0","13.14.1","13.14.2","13.14.3","13.15.0","13.16.0","13.16.1","13.16.2","13.17.0","13.17.1","13.17.2","13.18.0","13.2.0","13.3.0","13.3.1","13.4.0","13.4.1","13.5.0","13.6.0","13.7.0","13.8.0","13.9.0","14.0.0","14.0.1","15.0.0","15.0.1","15.0.2","15.0.3","15.0.4","16.0.0","16.0.1","16.0.2","16.0.3","16.0.4","16.0.5","16.0.6","16.1.0","16.1.1","16.10.0","16.10.1","16.10.2","16.10.3","16.10.4","16.11.0","16.11.1","16.12.0","16.12.1","16.13.0","16.14.0","16.15.0","16.15.1","16.16.0","16.16.1","16.17.0","16.17.1","16.2.0","16.3.0","16.3.1","16.3.2","16.3.3","16.3.4","16.4.0","16.4.1","16.4.2","16.4.3","16.5.0","16.6.0","16.7.0","16.7.1","16.8.0","16.8.1","16.9.0","17.0.0","17.1.0","17.2.0","17.2.1","18.0.0","18.1.0","18.1.1","18.1.2","18.1.3","18.1.4","18.1.5","18.10.0","18.10.1","18.10.2","18.11.0","18.11.1","18.11.2","18.11.3","18.11.4","18.12.0","18.12.1","18.2.0","18.3.0","18.4.0","18.5.0","18.5.1","18.6.0","18.7.0","18.7.1","18.7.2","18.8.0","18.9.0","18.9.1","19.0.0","19.1.0","19.1.1","19.2.0","19.3.0","19.3.1","19.3.2","19.4.0","19.5.0","19.5.1","19.5.2","19.5.3","19.5.4","20.0.0","20.0.1","20.1.0","20.1.1","20.1.2","20.1.3","20.1.4","20.10.0","20.10.1","20.11.0","20.12.0","20.12.1","20.13.0","20.14.0","20.14.1","20.14.2","20.15.0","20.15.1","20.16.0","20.17.0","20.17.1","20.17.2","20.17.3","20.17.4","20.17.5","20.18.0","20.19.0","20.19.1","20.19.2","20.19.3","20.19.4","20.19.5","20.2.0","20.2.1","20.20.0","20.20.1","20.21.0","20.21.1","20.22.0","20.23.0","20.24.0","20.25.0","20.26.0","20.26.1","20.26.2","20.3.0","20.3.1","20.3.2","20.3.3","20.4.0","20.5.0","20.5.1","20.5.2","20.5.3","20.5.4","20.6.0","20.7.0","20.8.0","20.8.1","20.9.0","20.9.1","20.9.10","20.9.11","20.9.12","20.9.2","20.9.3","20.9.5","20.9.6","20.9.7","20.9.8","20.9.9","21.0.0","21.1.0","21.10.0","21.11.0","21.12.0","21.12.1","21.12.2","21.13.0","21.2.0","21.3.0","21.3.1","21.4.0","21.4.1","21.4.2","21.4.3","21.4.4","21.5.0","21.5.1","21.5.2","21.5.3","21.5.4","21.5.5","21.5.6","21.5.7","21.6.0","21.6.1","21.6.2","21.6.3","21.6.4","21.6.5","21.6.6","21.6.7","21.6.8","21.6.9","21.7.0","21.7.1","21.7.2","21.8.0","21.8.1","21.8.2","21.8.3","21.9.0","21.9.1","21.9.2","21.9.3","22.0.0","22.0.1","22.1.0","22.1.1","22.1.2","22.1.3","22.10.0","22.10.1","22.10.2","22.10.3","22.11.1","22.11.2","22.12.0","22.13.0","22.14.0","22.15.0","22.16.0","22.17.0","22.17.1","22.17.2","22.18.0","22.19.0","22.19.1","22.19.2","22.19.3","22.19.4","22.19.5","22.19.6","22.19.7","22.19.8","22.2.0","22.2.1","22.2.2","22.20.0","22.20.1","22.21.0","22.21.1","22.22.0","22.23.0","22.23.1","22.23.2","22.24.0","22.24.1","22.25.1","22.25.2","22.25.3","22.25.4","22.25.5","22.25.6","22.26.0","22.27.0","22.28.0","22.29.0","22.29.1","22.29.2","22.29.3","22.3.0","22.3.1","22.30.0","22.31.0","22.31.1","22.31.2","22.31.3","22.31.4","22.31.5","22.31.6","22.31.7","22.32.0","22.32.1","22.32.2","22.33.0","22.34.0","22.34.1","22.34.2","22.34.3","22.34.4","22.35.0","22.36.0","22.36.1","22.37.0","22.37.2","22.37.3","22.37.4","22.38.0","22.38.1","22.38.2","22.38.3","22.39.0","22.39.1","22.4.0","22.4.1","22.40.1","22.40.2","22.40.3","22.40.4","22.40.5","22.41.0","22.41.1","22.41.2","22.41.3","22.42.0","22.43.0","22.43.1","22.43.2","22.44.0","22.44.1","22.44.2","22.44.3","22.44.4","22.44.5","22.45.0","22.46.0","22.46.1","22.46.2","22.46.3","22.46.4","22.46.5","22.46.6","22.47.0","22.47.1","22.48.0","22.48.1","22.49.0","22.49.1","22.49.2","22.5.0","22.5.1","22.5.2","22.50.0","22.51.0","22.52.0","22.53.0","22.54.0","22.54.1","22.54.10","22.54.11","22.54.12","22.54.2","22.54.3","22.54.4","22.54.5","22.54.6","22.54.7","22.54.9","22.55.0","22.55.1","22.56.0","22.56.1","22.56.2","22.56.3","22.57.0","22.57.2","22.57.3","22.57.4","22.57.5","22.58.0","22.59.0","22.6.0","22.6.1","22.60.0","22.61.0","22.61.1","22.61.2","22.61.3","22.61.4","22.61.5","22.62.0","22.62.2","22.62.3","22.63.0","22.63.1","22.63.2","22.63.3","22.64.0","22.65.0","22.65.1","22.66.0","22.67.0","22.67.1","22.68.0","22.69.0","22.7.0","22.70.0","22.70.1","22.71.0","22.71.1","22.72.0","22.73.0","22.74.0","22.74.1","22.75.0","22.75.1","22.75.2","22.75.3","22.75.4","22.75.5","22.76.0","22.76.1","22.77.1","22.77.2","22.78.0","22.78.1","22.78.2","22.78.3","22.78.4","22.78.5","22.78.6","22.78.7","22.78.8","22.78.9","22.79.0","22.79.1","22.8.0","22.8.1","22.8.2","22.8.3","22.8.4","22.8.5","22.8.6","22.80.0","22.80.1","22.81.0","22.81.1","22.81.2","22.81.3","22.81.4","22.81.5","22.82.0","22.83.0","22.83.1","22.84.0","22.84.1","22.84.2","22.84.3","22.84.4","22.84.5","22.84.6","22.85.0","22.85.1","22.85.2","22.85.3","22.85.4","22.85.5","22.85.6","22.86.0","22.87.0","22.88.0","22.89.0","22.89.1","22.89.2","22.9.0","22.9.1","22.9.2","22.9.3","22.9.4","22.90.0","22.90.1","22.90.2","22.90.3","22.91.0","23.0.0","23.1.0","23.1.1","23.2.0","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.3.0","23.3.1","23.3.3","23.3.4","23.3.5","23.3.6","23.4.0","23.5.0","23.6.0","23.6.1","23.6.2","23.6.3","23.6.4","23.7.0","23.7.1","23.7.2","23.7.3","23.8.0","23.8.1","23.8.2","24.0.0","24.0.1","24.0.2","24.0.3","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","25.0.0","25.1.0","25.2.0","25.2.1","25.2.2","25.3.0","26.0.0","26.0.1","26.0.2","26.0.3","26.0.4","26.0.5","26.0.6","26.0.7","26.0.8","26.0.9","26.1.0","26.1.1","26.1.2","26.2.0","26.2.1","26.3.0","26.3.1","26.3.2","26.3.3","26.3.4","26.3.5","26.4.0","26.4.1","26.4.2","26.4.3","26.5.0","26.5.1","26.6.0","26.6.1","26.6.2","26.6.3","26.7.0","26.7.1","26.7.2","26.7.3","26.7.4","26.7.5","27.0.0","27.0.1","27.0.10","27.0.11","27.0.2","27.0.3","27.0.4","27.0.5","27.0.6","27.0.7","27.0.8","27.1.1","27.1.10","27.1.11","27.1.12","27.1.13","27.1.14","27.1.15","27.1.16","27.1.17","27.1.18","27.1.19","27.1.2","27.1.20","27.1.21","27.1.22","27.1.23","27.1.24","27.1.25","27.1.26","27.1.28","27.1.29","27.1.3","27.1.30","27.1.31","27.1.32","27.1.33","27.1.34","27.1.35","27.1.36","27.1.37","27.1.38","27.1.39","27.1.4","27.1.40","27.1.41","27.1.42","27.1.43","27.1.44","27.1.45","27.1.46","27.1.47","27.1.48","27.1.49","27.1.5","27.1.50","27.1.51","27.1.52","27.1.53","27.1.55","27.1.56","27.1.57","27.1.58","27.1.59","27.1.6","27.1.60","27.1.61","27.1.62","27.1.64","27.1.7","27.1.8","27.1.9","27.2.0","27.2.1","27.2.10","27.2.11","27.2.12","27.2.13","27.2.14","27.2.15","27.2.2","27.2.3","27.2.4","27.2.5","27.2.6","27.2.7","27.2.8","27.2.9","27.3.0","27.3.1","27.3.10","27.3.11","27.3.12","27.3.13","27.3.2","27.3.3","27.3.4","27.3.5","27.3.7","27.3.8","27.3.9","28.0.0","28.0.1","28.0.2","28.0.3","28.0.4","28.0.5","29.0.0","29.0.1","29.0.2","29.0.3","29.1.0","29.1.1","29.1.2","29.1.3","29.1.4","29.1.5","29.1.6","29.1.7","29.2.0","29.3.0","29.3.1","29.4.0","29.4.1","29.4.10","29.4.11","29.4.12","29.4.13","29.4.2","29.4.3","29.4.4","29.4.5","29.4.6","29.4.7","29.4.8","29.4.9","29.5.0","29.5.1","29.5.2","29.5.3","29.5.4","29.5.5","29.5.6","29.5.7","29.6.0","29.7.0","29.7.1","29.8.0","29.8.1","29.8.2","29.8.3","29.8.4","29.8.5","29.8.6","29.8.7","30.0.0","30.1.0","30.1.1","30.1.2","30.1.4","30.2.0","30.2.2","30.2.3","30.2.4","30.2.6","30.2.7","30.3.0","31.0.0","31.0.1","31.0.2","31.1.0","31.1.2","31.1.3","31.1.4","31.1.5","31.1.6","31.2.0","31.2.1","31.2.2","31.2.3","32.0.0","32.1.0","32.2.0","32.2.1","32.2.2","32.2.3","32.2.4","32.2.5","32.2.7","32.2.8","33.0.0","33.0.1","33.0.2","33.0.3","33.0.4","33.0.5","33.0.6","33.1.0","33.1.1","33.1.2","33.1.3","33.1.4","33.1.5","33.1.6","33.2.0","33.2.1","33.2.3","33.3.0","33.3.1","33.3.2","33.3.3","33.3.4","34.0.0","35.0.1","35.0.2","36.0.1","36.0.2","36.0.3","36.0.4","36.1.0","36.2.1","36.2.2","36.2.3","36.2.4","36.2.5","36.2.6","36.2.7","36.3.0","36.3.1","36.3.2","36.4.0","36.4.1","36.4.2","36.5.0","36.5.1","37.0.0","37.0.1","37.0.10","37.0.11","37.0.12","37.0.13","37.0.14","37.0.15","37.0.16","37.0.17","37.0.2","37.0.20","37.0.21","37.0.22","37.0.23","37.0.24","37.0.25","37.0.26","37.0.28","37.0.3","37.0.4","37.0.5","37.0.6","37.0.7","37.0.8","37.0.9","37.1.0","37.2.0","38.0.0","38.0.1","38.0.2","38.1.0","38.1.1","38.1.2","38.1.3","38.1.4","38.1.5","38.1.6","38.1.7","38.1.8","38.1.9","38.2.0","38.2.1","38.2.10","38.2.2","38.2.3","38.2.4","38.2.5","38.2.6","38.2.7","38.2.8","38.2.9","38.3.0","38.3.1","38.3.2","38.3.3","38.3.4","38.3.5","39.0.0","39.1.0","40.0.0","40.0.1","40.1.0","40.1.1","40.1.2","40.1.3","40.1.4","40.1.5","40.10.0","40.10.1","40.11.0","40.11.1","40.12.0","40.12.1","40.12.2","40.12.3","40.12.4","40.2.0","40.2.1","40.2.2","40.2.3","40.3.0","40.3.1","40.3.2","40.3.3","40.4.0","40.4.1","40.5.0","40.5.1","40.6.0","40.6.1","40.6.2","40.6.3","40.7.0","40.7.1","40.8.1","40.8.2","40.9.1","40.9.2","40.9.4","40.9.5","40.9.6","40.9.7","41.0.0","41.0.1","41.0.2","42.0.0","43.0.0","43.0.1","43.0.2","43.0.3","43.0.4","43.0.5","44.0.0","44.0.1","44.0.2","44.0.3","44.0.4","44.0.5","45.0.0","45.0.1","45.0.10","45.0.11","45.0.12","45.0.13","45.0.14","45.0.15","45.0.16","45.0.17","45.0.2","45.0.3","45.0.4","45.0.5","45.0.6","45.0.7","45.0.8","45.0.9","45.1.0","45.1.1","45.1.2","45.1.3","45.2.0","45.2.1","45.2.2","45.3.0","45.4.0","45.4.1","45.4.2","45.4.3","45.4.4","45.4.5","45.5.0","45.5.1","45.5.2","45.5.3","45.5.4","45.5.5","46.0.0","46.0.1","46.0.2","46.0.3","46.0.4","46.0.5","47.0.0","47.0.1","48.0.0","49.0.0","49.0.1","49.0.10","49.0.11","49.0.12","49.0.13","49.0.14","49.0.16","49.0.2","49.0.3","49.0.4","49.0.5","49.0.6","49.0.7","49.0.8","49.0.9","49.1.0","49.2.0","49.3.0","49.4.0","49.4.1","49.4.2","49.4.3","49.4.4","49.4.5","49.4.6","49.4.7","49.5.0","49.5.1","49.5.2","50.0.0","50.1.0","50.1.1","50.1.10","50.1.2","50.1.3","50.1.4","50.1.5","50.1.6","50.1.7","50.1.8","50.1.9","51.0.0","51.0.1","51.0.2","51.0.3","51.0.4","51.0.5","51.0.6","51.0.7","51.0.8","51.0.9","51.1.0","51.1.1","51.1.2","51.1.3","51.10.0","51.10.1","51.10.2","51.10.3","51.10.4","51.10.5","51.10.6","51.10.7","51.2.0","51.2.1","51.2.2","51.2.3","51.2.4","51.2.5","51.2.6","51.2.7","51.2.8","51.2.9","51.3.0","51.3.1","51.4.0","51.4.1","51.5.1","51.5.10","51.5.11","51.5.12","51.5.13","51.5.14","51.5.15","51.5.2","51.5.3","51.5.4","51.5.5","51.5.6","51.5.7","51.5.8","51.5.9","51.6.0","51.6.1","51.6.10","51.6.11","51.6.12","51.6.13","51.6.14","51.6.2","51.6.3","51.6.4","51.6.5","51.6.6","51.6.7","51.6.8","51.6.9","51.7.0","51.7.1","51.7.2","51.7.3","51.7.4","51.7.5","51.7.6","51.8.0","51.8.1","51.9.0","51.9.1","51.9.10","51.9.2","51.9.3","51.9.4","51.9.5","51.9.6","51.9.7","51.9.8","52.0.0","52.0.1","52.0.10","52.0.11","52.0.2","52.0.3","52.0.4","52.0.5","52.0.6","52.0.7","52.0.8","52.0.9","52.1.0","52.1.1","52.1.2","52.1.3","52.1.4","52.1.5","52.1.6","53.0.0","53.0.1","53.0.2","53.1.0","53.1.1","53.1.10","53.1.11","53.1.2","53.1.3","53.1.4","53.1.5","53.1.6","53.1.7","53.1.8","53.1.9","53.2.0","53.3.0","53.4.0","53.4.1","53.4.2","53.4.3","53.4.4","53.4.5","53.4.6","53.4.7","53.4.8","53.5.0","53.5.1","53.5.2","53.5.3","53.5.4","53.6.0","54.0.0","54.1.0","54.1.1","54.1.2","54.1.3","54.10.0","54.10.1","54.10.2","54.10.3","54.10.4","54.10.5","54.10.6","54.10.7","54.2.0","54.2.1","54.3.0","54.3.1","54.4.0","54.4.1","54.4.10","54.4.2","54.4.3","54.4.4","54.4.5","54.4.6","54.4.7","54.4.8","54.4.9","54.5.0","54.5.1","54.5.2","54.5.3","54.6.0","54.6.1","54.7.0","54.9.0","54.9.1","55.0.0","55.1.0","55.1.1","55.2.0","55.2.1","55.2.2","55.2.3","55.3.0","55.3.1","55.3.10","55.3.2","55.3.3","55.3.4","55.3.5","55.3.6","55.3.7","55.3.8","55.3.9","55.4.0","55.4.1","55.4.10","55.4.11","55.4.2","55.4.3","55.4.4","55.4.5","55.4.6","55.4.7","55.4.8","55.4.9","55.5.0","55.6.0","55.6.1","55.6.2","56.0.0","56.0.1","56.0.2","56.1.0","56.2.0","56.2.1","56.2.2","56.2.3","56.2.4","56.2.5","56.2.6","56.2.7","56.2.8","56.3.0","56.3.1","56.3.2","56.3.3","56.3.4","56.3.5","56.3.6","56.3.7","56.3.8","56.3.9","57.0.0","57.0.1","57.0.2","57.0.3","57.0.4","57.0.5","57.0.6","57.0.7","58.0.0","58.1.0","58.1.1","58.1.2","58.1.3","58.1.4","58.1.5","58.1.6","58.1.7","58.1.8","58.1.9","59.0.0","59.1.0","59.1.1","59.10.0","59.10.1","59.10.2","59.10.3","59.10.4","59.10.5","59.10.6","59.10.7","59.10.8","59.11.0","59.11.1","59.11.2","59.12.0","59.14.0","59.14.1","59.14.10","59.14.11","59.14.12","59.14.13","59.14.2","59.14.3","59.14.4","59.14.5","59.14.6","59.14.7","59.14.8","59.14.9","59.15.0","59.15.1","59.15.2","59.15.3","59.15.4","59.15.5","59.16.0","59.17.0","59.17.1","59.17.2","59.17.3","59.18.0","59.2.0","59.2.1","59.20.1","59.20.2","59.20.3","59.20.4","59.20.5","59.20.6","59.20.7","59.21.0","59.22.0","59.22.1","59.22.2","59.22.3","59.22.4","59.22.5","59.22.6","59.22.7","59.23.0","59.24.0","59.24.1","59.24.2","59.25.0","59.25.1","59.25.2","59.25.3","59.25.4","59.25.5","59.25.6","59.25.7","59.25.8","59.3.0","59.3.1","59.4.0","59.4.1","59.4.2","59.4.3","59.4.4","59.4.5","59.4.6","59.4.7","59.5.0","59.5.1","59.5.2","59.5.3","59.5.4","59.5.6","59.5.7","59.5.8","59.5.9","59.6.0","59.6.1","59.6.2","59.6.3","59.7.0","59.7.1","59.7.2","59.7.3","59.8.0","59.9.0","59.9.1","60.0.0","60.1.0","60.1.1","60.1.2","60.1.3","60.1.4","60.1.5","60.1.6","60.2.0","60.2.1","60.2.10","60.2.2","60.2.3","60.2.4","60.2.5","60.2.6","60.2.8","60.2.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-w228-rfpx-fhm4/GHSA-w228-rfpx-fhm4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}