Description

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-08T14:17:26.333Z",
  "pubdate": "2026-09-08T14:17:26.333Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to a Cross-Site Scripting (XSS) vulnerability located within the dynamic redirect handler.\nThis security flaw stems from insufficient input validation of URIs, enabling an unauthenticated attacker to inject malicious javascript: pseudo-protocols.\nBy bypassing host validation mechanisms via percent-encoded newlines and authority component obfuscation, an attacker can force an authenticated user to execute arbitrary JavaScript in the context of the application's origin.\nThe vulnerability poses a high risk to user security, as successful exploitation results in complete compromise of the authenticated user's session, potentially leading to unauthorized actions, account takeover, or data exfiltration.\nExploitation requires the attacker to trick an authenticated user into performing a specific action—namely, triggering a manipulated 'Follow' link—which the application then processes through the flawed redirection logic.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and sanitization of user-supplied input intended for the dynamic redirect handler. The application fails to effectively neutralize javascript: URIs when the attacker provides a maliciously crafted URI authority component.\nSpecifically, the attacker can embed the target board's hostname within the URI structure to deceive naive validation checks. By utilizing percent-encoded newlines (e.g., %0A or %0D) within the input, the attacker successfully bypasses regex-based or string-matching filters that expect a standard HTTP or HTTPS URI structure. The underlying server-side code mistakenly treats the payload as a legitimate redirect target, subsequently rendering it into the response HTML.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious link containing the javascript: payload, obfuscated to bypass hostname validation checks. Second, the attacker distributes this link to authenticated users, typically via social engineering or forum posts, encouraging the user to engage with a 'Follow' action. Third, upon clicking the link, the application processes the redirect by including the malicious URI in the browser's navigation path. Fourth, the browser interprets the javascript: protocol within the context of the application's origin. Finally, the injected JavaScript executes with the permissions of the authenticated user session.\nBecause the payload executes in the security context of the board's domain, it bypasses Same-Origin Policy (SOP) restrictions, allowing the attacker to read session tokens, perform requests on behalf of the user, or modify the DOM to steal sensitive credentials. This vulnerability is particularly potent because it effectively weaponizes the application's own redirect logic to deliver a payload that is seemingly authorized by the host server. The absence of strict URI schema validation allows the protocol handler to switch from an expected network navigation to script execution, thereby turning a benign redirection feature into an arbitrary code execution vector."
}