Description
Drupal Core allows overriding the redirect target using the destination query parameter. This allows an attacker to redirect the user to an external domain. For example, the following URL:
http://www.drupal.local//?destination=https://attacker.com\@www.drupal.local/will redirect the user to the domain attacker.com.
Remediation
Upgrade to the latest version of Drupal.
Block requests with multiple forward slashes that contain an external domain in the destination parameter.
References
Related Vulnerabilities
WordPress Plugin Daily Inspiration Generator Open Redirect (2.0)
XWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-29204)
WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.26)
WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.24)
WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Open Redirect (4.4.1)