CVE-2023-26494 lorawan-stack has open redirect vulnerability
An open redirect in the login page allows attackers to redirect users to malicious sites, facilitating phishing attacks against LoRaWAN network server users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-26494?
CVE-2023-26494 is a medium-severity vulnerability in TheThingsNetwork lorawan-stack, published on 24 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.
Weakness: CWE-601
Which versions are affected by CVE-2023-26494?
4 open source packages ship an affected version, including go.thethings.network/lorawan-stack/v3 and go.thethings.network/lorawan-stack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go.thethings.network/lorawan-stack/v3 Go | All versions | 3.24.1 |
go.thethings.network/lorawan-stack/v3 Go | All versions | 3.24.1 |
go.thethings.network/lorawan-stack/v3 Go | All versions | 3.24.1 |
go.thethings.network/lorawan-stack Go | All versions | None |
Products include Thethingsnetwork Lorawan-Stack.
How do I fix CVE-2023-26494?
Upgrade go.thethings.network/lorawan-stack/v3 to 3.24.1 or later.
Is CVE-2023-26494 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26494 exists.
Sources
Also known as GHSA-5fwq-9x7j-2qpg, GO-2024-3044.