Description

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T20:17:21.013Z",
  "pubdate": "2026-09-01T20:17:21.013Z",
  "executiveSummary": "This vulnerability involves an Open Redirect flaw present in the web-based management interface of HPE Networking Fabric Composer. The issue resides in the application's handling of user-supplied input used to navigate or redirect users to specific locations.\nThe vulnerability allows an unauthenticated remote attacker to craft malicious URLs that, when accessed by an authenticated user, force the browser to navigate to an arbitrary, attacker-controlled destination. This effectively facilitates phishing, credential harvesting, or the delivery of malicious content by leveraging the trusted context of the legitimate HPE Networking Fabric Composer domain.\nThe risk implication is significant as it undermines the integrity of the application's navigation logic, potentially exposing users to social engineering attacks. Successful exploitation requires the attacker to entice a legitimate user into clicking a specially crafted link while they possess an active session or are navigating the management interface. No prior authentication is required from the attacker to initiate this redirection, as the flaw exists within the interface logic itself. The primary impact is the loss of user trust and the potential compromise of user-sensitive data or session security through subsequent interaction with malicious third-party sites.",
  "technicalDetails": "The vulnerability is a classic Open Redirect flaw stemming from improper input validation within the web-based management interface of HPE Networking Fabric Composer. The root cause is the application's failure to sanitize or validate parameters that govern redirection, allowing these parameters to accept arbitrary external URLs rather than restricting navigation to pre-defined, trusted paths within the local application domain.\nExploitation is achieved by injecting a fully qualified URL into the redirection parameter of a legitimate interface endpoint. When the web application processes this request, it fails to perform domain-level verification, causing the server to issue an HTTP 3xx redirect response directing the client's user agent to the attacker-specified location.\nThe attack flow follows a structured path: First, the attacker identifies the vulnerable endpoint responsible for handling navigation or URL parameters within the HPE Networking Fabric Composer web console. Second, the attacker constructs a malicious URL incorporating an external domain into the target parameter. Third, the attacker distributes this link to authorized users of the system. Fourth, upon clicking the link, the user is redirected through the trusted HPE interface to the external malicious server. If the user has an active session, they may be susceptible to further exploitation, such as cross-site scripting (XSS) or the capture of session tokens if the malicious destination is designed to intercept them.\nBecause the redirection occurs within the context of the management interface, the visual appearance of the browser remains linked to the HPE product until the redirection completes, significantly increasing the success rate of social engineering campaigns. The vulnerability is categorized as a failure in input sanitization, where user-controlled input directly influences the server-side redirection logic without implementing a whitelist approach or relative-path enforcement.\nThis vulnerability is restricted to the web-based management interface of the affected HPE Networking Fabric Composer versions. There are no authentication requirements for the attacker to perform the redirect, as the flaw exists on public or semi-public segments of the interface logic that do not verify the initiator's identity before processing the redirect parameter. The exposure is limited to the network accessible to the management interface, and the post-exploitation impact is primarily focused on the client-side, enabling sophisticated phishing and potential session-related threats depending on the browser's interaction with the malicious site."
}