REDHAT-BUG-2546603: XSS
DOM-based cross-site scripting (XSS) vulnerability in the Ansible Platform UI's /redirect route (project: ansible/ansible-ui, affected component: platform/main/Redirect.tsx). The vulnerable Redirect component and /redirect route were introduced in commit df1902cc on 2024-04-23, and the upstream devel branch still pointed to the confirmed UI commit as of 2026-10-06. The root cause is that the next query parameter in Redirect.tsx flows directly to location.href without validation, even though the UI already provides a validateUrlPath helper (in frontend/common/AnsibleLogin/validateUrlPath.ts) that rejects javascript:, data:, absolute, and protocol-relative URLs — this helper is used by the login component but is not applied to the Redirect component, which is registered in usePlatformNavigation.tsx and exposed to authenticated users behind PlatformLogin after a valid Gateway session.
Affected Software
Event History
Frequently Asked Questions
Who can reach the vulnerable route?
The /redirect route is exposed to authenticated users after PlatformLogin when they have a valid Gateway session. It is registered through usePlatformNavigation.tsx.
What does an attacker need to exploit this issue?
An attacker needs to cause an authenticated user to use the /redirect route with a crafted next query parameter. The parameter is assigned directly to location.href without validation.
Are external or script-based redirect targets blocked?
No validation is applied by the vulnerable Redirect component. The existing validateUrlPath helper, which rejects javascript:, data:, absolute, and protocol-relative URLs, is used by the login component but not by this route.
How can I determine whether my UI contains the vulnerable code?
Check whether the deployed UI includes the Redirect component and /redirect route introduced in commit df1902cc. Also verify whether Redirect.tsx validates the next parameter with validateUrlPath before assigning it to location.href.