关键漏洞信息 漏洞名称 OnboardLite Open Redirect Endpoint 漏洞ID CVE-2025-55751 影响版本 Before Commit: 0d7111bfb853ea462c24c6798d43461c67e45bd9 修复版本 After Commit: 6cca19ea4f47af125caa08ef82594844f039e07e 漏洞严重性 Moderate (CVSS v4 base metrics: 5.1/10) 漏洞描述 CWE-601: URL Redirection to Untrusted Site (Open Redirect). An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing, credential theft, malware delivery, and trust abuse. 技术细节 Two endpoints accepted a redirect as a user-supplied parameter. There was rudimentary validation logic in place to confirm that redirect host returned only to join.hackucf.org. 示例代码 解决方案 Any version after commit hash implements JWT signing for the redirect URL parameter. 参考资料 CWE-601: https://cwe.mitre.org/data/definitions/601.html OWASP Unvalidated Redirects and Forwards Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html OWASP Testing Guide: Testing for Unvalidated Redirects and Forwards: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_for_Unvalidated_Redirects_and_Forwards RFC 3986 (URI Generic Syntax): https://www.rfc-editor.org/rfc/rfc3986