CVE-2021-32645 Open Redirect in tenancy
Attackers can redirect users to malicious sites via crafted URLs in specific Laravel tenancy configurations, requiring a patch or configuration change.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32645?
CVE-2021-32645 is a medium-severity vulnerability in tenancy multi-tenant, published on 27 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
Weakness: CWE-601
Which versions are affected by CVE-2021-32645?
2 open source packages ship an affected version, including hyn/multi-tenant. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hyn/multi-tenant Packagist | From 5.6.0 | 5.7.2 |
hyn/multi-tenant Packagist | From 5.6.0 | 5.7.2 |
Products include Tenancy Multi-Tenant.
How do I fix CVE-2021-32645?
Upgrade hyn/multi-tenant to 5.7.2 or later.
Is CVE-2021-32645 being exploited?
There is no known exploitation of CVE-2021-32645 in the wild and no public exploit code.
Sources
Also known as GHSA-4r8q-gv9j-3xx6.