Description

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T14:17:11.850Z",
  "pubdate": "2026-11-06T14:17:11.850Z",
  "executiveSummary": "HCL AION contains an open redirect vulnerability located within the user registration module. This flaw arises from the improper validation of the 'redirect' query parameter processed by the Signup component. An attacker can leverage this vulnerability to construct a malicious URL that, upon successful account registration, redirects the user to an arbitrary, attacker-controlled external domain.\nThis vulnerability is categorized as an Open Redirect, which typically facilitates phishing and social engineering campaigns. By weaponizing trusted links associated with HCL AION, attackers can deceive users into visiting malicious websites, potentially leading to credential harvesting, malware distribution, or further exploitation of the victim's session context. The vulnerability does not require prior authentication, as it is exposed on the public-facing registration page. While the vulnerability does not directly compromise the HCL AION application server, it presents significant security implications for end-users, as it abuses the application's perceived trustworthiness to bypass security awareness and deliver deceptive content.",
  "technicalDetails": "The vulnerability resides in the application's handling of HTTP GET requests directed toward the user registration endpoint. Specifically, the Signup component fails to implement an allowlist or any server-side validation mechanism for the 'redirect' query parameter. When a user submits registration data, the application logic reads the target URL directly from this parameter to determine the destination of the post-registration navigation.\nThe attack flow begins when an attacker crafts a malicious URL pointing to the legitimate HCL AION registration page but appends a modified 'redirect' parameter containing the URL of an external, malicious resource. For example, 'https://hcl-aion-instance/signup?redirect=https://malicious-site.com'.\nOnce the victim accesses the crafted link and completes the registration process, the HCL AION server processes the 'redirect' parameter without verifying if the target domain belongs to a trusted set of internal or approved external hosts. Consequently, the application responds with an HTTP 302 redirect or equivalent client-side navigation trigger, forcing the user's browser to navigate to the attacker's domain.\nThe component responsible for this behavior is the Signup component, which inadequately sanitizes input before utilizing it in the application's redirection logic. Because the registration page is typically exposed to the public internet, no authentication or special privileges are required to initiate the attack. The lack of domain validation allows for the redirection to any protocol or domain supported by the browser, including potential URI schemes if not properly constrained.\nThe impact of this exploitation is primarily focused on the degradation of the user's trust. Phishing campaigns utilizing this redirect can appear legitimate because the initial request originates from the trusted HCL AION domain. This technique is often used to bypass email filters or user scrutiny. Furthermore, if the victim remains logged into the application, session-specific information could potentially be leaked if the attacker's site attempts to perform cross-origin requests, depending on the browser's implementation of Same-Origin Policy and Cross-Origin Resource Sharing (CORS) configurations. The absence of input validation represents a failure to adhere to secure software development life cycle (SDLC) practices regarding the handling of untrusted user-supplied data in redirection scenarios."
}