Description

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T12:19:33.370Z",
  "pubdate": "2026-08-18T12:19:33.370Z",
  "executiveSummary": "The Grav API plugin (getgrav/grav-plugin-api), specifically when bundled with Grav 2.0's admin-next/API stack in versions prior to 1.0.14, suffers from an open redirect vulnerability located within the SsoController::sanitizeReturnTo() function. This weakness stems from flawed input sanitization that fails to account for browser-side normalization of backslashes into forward slashes within HTTP and HTTPS URI schemes.\nThe primary impact of this vulnerability is post-login phishing, where an authenticated victim can be seamlessly redirected to an attacker-controlled external domain following a legitimate OAuth authentication flow. The attacker capabilities involve manipulating the returnTo parameter to craft a deceptive URL that bypasses built-in validation checks.\nFull browser-side exploitability is contingent upon the admin-next Single Page Application (SPA) client-side oauth-callback handler processing the parameters accordingly. Risk implications include credential harvesting, session token exposure, and targeted social engineering attacks against administrative users. Remediation requires updating the Grav API plugin to version 1.0.14 or later to ensure robust sanitization of return parameters against path normalization discrepancies.",
  "technicalDetails": "The root cause of the vulnerability resides in the input validation logic implemented in SsoController::sanitizeReturnTo() within the Grav API plugin. The function attempts to prevent open redirect attacks by inspecting the returnTo parameter and explicitly rejecting values that begin with a literal double-forward-slash (//) prefix. However, this defense mechanism is insufficient because it does not anticipate or handle browser normalization behaviors.\nSpecifically, modern web browsers routinely normalize backslashes (\\) to forward slashes (/) when parsing URLs within HTTP and HTTPS schemes. An attacker can exploit this discrepancy by supplying a crafted returnTo value containing a backslash followed by a forward slash or domain name, such as '/\\evil.com'. While this payload evades the initial string-matching guard in SsoController::sanitizeReturnTo() because it lacks the literal '//' sequence, the target browser normalizes the backslash during URI resolution.\nConsequently, the browser interprets the resulting string as a protocol-relative URL pointing to '//evil.com'. The attack flow begins when an attacker induces an authenticated or pre-authenticated victim to initiate an OAuth login flow involving the vulnerable Grav instance with the maliciously crafted returnTo parameter. Upon successful completion of the legitimate authentication workflow, the application references the sanitized returnTo value to redirect the user.\nBecause the browser normalizes the parameter into an external protocol-relative URL, the victim is forcefully navigated away from the trusted Grav administration interface and onto an attacker-controlled server. This redirection occurs transparently after a successful login, increasing the victim's susceptibility to subsequent post-login phishing campaigns designed to capture sensitive credentials or perform further client-side exploitation. The affected component is the SsoController class within the Grav API plugin for versions prior to 1.0.14. The vulnerability requires network exposure, interacts directly with the OAuth authentication flow, and exploits client-side URI parsing mechanics without requiring prior administrative privileges."
}