GHSA-wg2f-x2c2-c4rp: Medium severity composer/snipe/snipe-it vulnerability
Impact The user edit flow stores url()->previous() into Laravel's intended URL session value and later redirects with redirect()->intended(...) when redirectoption=back is submitted. Because the previous URL is derived from the attacker-controlled Referer header, an authenticated user performing a normal user-edit action can be redirected to an external attacker-controlled site.
An attacker who can cause a logged-in user with permission to edit a user record to open the edit page with an attacker-controlled Referer value.
The application can be used as a trusted redirector after a legitimate user edit action. This can support phishing or trust-boundary attacks against Snipe-IT users and matches a historical open redirect class where session-stored navigation context influences redirect destinations.
Patches Patched in f4cac96358
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Patch f4cac96358
Event History
Frequently Asked Questions
Who is exposed to this redirect issue?
An attacker must target a logged-in user who has permission to edit a user record. The user must open the edit page with an attacker-controlled Referer value and then perform a normal user-edit action.
What configuration or workflow triggers the vulnerable redirect?
The affected path is used when the user-edit submission includes redirect_option=back. In that flow, the application stores the previous URL in the session and later redirects to it using the intended redirect mechanism.
What can an attacker do with this behavior?
The attacker can cause the application to redirect the authorized user to an external attacker-controlled site after the legitimate edit action. This can make the application act as a trusted redirector for phishing or trust-boundary attacks.
What patch information is available?
The issue is patched in commit f4cac96358.