GHSA-564j-v29w-rqr6 Khoj Open Redirect Vulnerability in Login Page
Attackers can redirect users to malicious sites via the login page's next parameter, facilitating phishing attacks against Khoj users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-564j-v29w-rqr6?
GHSA-564j-v29w-rqr6 is a vulnerability in khoj-assistant, published on 8 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summary
An attacker can use the next parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking app.khoj.dev url.
For example, https://app.khoj.dev/login?next=//example.com will redirect to the https://example.com page.
Details
The problem seems to be in this method: https://github.com/khoj-ai/khoj/blob/2667ef45449eb408ce1d7c393be04845be31e15f/src/khoj/routers/auth.py#L95
PoC
Open the https://app.khoj.dev/login?next=//example.com url in a Gecko-based browser (Firefox).
Impact
The impact is low, and this could only be used in phishing attempts, but it's still a problem nonetheless.
Which versions are affected by GHSA-564j-v29w-rqr6?
2 open source packages ship an affected version, including khoj-assistant.
| Package | Affected | Fixed in |
|---|---|---|
khoj-assistant PyPI | All versions | 1.14.0 |
khoj-assistant PyPI | All versions | 1.14.0 |
How do I fix GHSA-564j-v29w-rqr6?
Upgrade khoj-assistant to 1.14.0 or later.
Is GHSA-564j-v29w-rqr6 being exploited?
There is no known exploitation of GHSA-564j-v29w-rqr6 in the wild and no public exploit code.