Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-21T19:17:15.190Z",
  "pubdate": "2026-09-21T19:17:15.190Z",
  "executiveSummary": "Warpgate versions prior to 0.27.6 contain a vulnerability involving the improper sanitization of user-controlled input within the SSO 'form_post' return path. Specifically, the application fails to neutralize script-closing sequences when generating HTTP responses using serde_json::to_string.\nThis vulnerability allows an attacker to inject arbitrary HTML markup, such as deceptive login forms, content spoofing, or meta refresh tags, into the victim's browser session. While the application's Content-Security-Policy (CSP) mitigates the risk of direct cross-site scripting (XSS) via JavaScript execution or event handlers, the ability to manipulate the rendered content poses a significant risk to user trust and authentication integrity.\nExploitation requires the attacker to influence the 'next' redirect parameter or leverage IdP-derived error messages that lack proper URL encoding. The attack flow is triggered when a victim completes an SSO flow through an identity provider manipulated by the attacker. Because the vulnerability exists within the authentication flow, it facilitates social engineering and potential credential harvesting through spoofed interface elements, despite the CSP protections in place.",
  "technicalDetails": "The root cause of the vulnerability resides in warpgate-protocol-http/src/api/sso_provider_list.rs within the ReturnToSsoPostResponse implementation. The application utilizes serde_json::to_string to serialize data into an HTML template; however, it fails to sanitize or escape characters that terminate a <script> block, specifically the '</script>' sequence. This oversight allows an attacker to prematurely close the script context and inject arbitrary HTML markup directly into the document body.\nAttackers can reach the vulnerable code path through two primary vectors: the 'next' redirect parameter processed by warpgate-protocol-http/src/api/sso_provider_detail.rs, or through malicious IdP-derived error messages generated by make_redirect_url. The latter occurs when the application concatenates these error messages into the redirect URL without applying appropriate URL encoding. This makes the vulnerability exploitable if an attacker controls a configured Identity Provider or can inject malicious payloads into identity claims, such as usernames or email addresses, that the IdP passes back to Warpgate.\nThe exploitation flow follows these steps: 1) The attacker initiates an authentication process where they control the input parameters (either the 'next' redirect or the IdP identity claims). 2) The attacker crafts a payload containing a script-closing sequence followed by arbitrary HTML markup (e.g., a spoofed login form). 3) The victim initiates the SSO 'form_post' flow via an attacker-influenced identity provider. 4) The Warpgate server generates the response containing the serialized, unneutralized attacker-controlled string. 5) The victim's browser processes the response, closing the script block prematurely and rendering the injected HTML payload.\nWhile the Content-Security-Policy implemented in Warpgate prevents the execution of malicious JavaScript and the triggering of inline event handlers, the impact remains significant. An attacker can perform content spoofing to trick the user into providing credentials on a fake form, or initiate a meta refresh to redirect the user to a malicious site. The vulnerability affects versions of Warpgate prior to 0.27.6 and is contingent on the victim successfully completing the specific SSO flow that utilizes the vulnerable 'form_post' return path."
}