iframe-proxy

snoopysecurity · 2026-05-15T11:37:19Z

PR fixes a security issue Open Redirect via Referer Header in Response::goBack

Summary of security issue

Typecho\Widget\Response::goBack redirects users to the value of the Referer request header without verifying that the host matches Typecho's own host. Because Widget\Security::protect() calls goBack() whenever a CSRF token is missing or mismatched, any /action/<name> endpoint can be turned into an open redirect by a cross-origin page that simply links to it without providing the _=<token> parameter. No authentication is required.

Summary of fix

In Response::goBack, only redirect to the Referer if its host matches the host the request was served from. Otherwise fall back to $default (or /). This preserves the legitimate UX (stale-token bounce back) while removing the cross-origin redirect primitive.

More information regarding the security issue

1. `Widget\Security::protect()` — `var/Widget/Security.php:63`

public function protect()
{
    if ($this->enabled && $this->request->get('_') != $this->getToken($this->request->getReferer())) {
        $this->response->goBack();   // <-- redirects on CSRF failure
    }
}

Every action handler in /action/<name> calls $this->security->protect()
near the top of action(). When the _=<token> query parameter is missing
or stale, protect() triggers goBack() instead of throwing an error.

2. `Typecho\Widget\Response::goBack()` — `var/Typecho/Widget/Response.php:187`

public function goBack(?string $suffix = null, ?string $default = null)
{
    $referer = $this->request->getReferer();

    if (!empty($referer)) {
        // ... optional suffix-merge logic ...
        $this->redirect($referer);    // <-- redirects to raw Referer
    } else {
        $this->redirect($default ?: '/');
    }
}

The Referer value is passed straight to redirect().

3. `Typecho\Widget\Response::redirect()` — line 172

public function redirect(string $location, bool $isPermanently = false)
{
    $location = Common::safeUrl($location);   // strips control chars only
    $this->response->setStatus($isPermanently ? 301 : 302)
        ->setHeader('Location', $location)
        ->respond();
}

4. `Common::safeUrl()` — `var/Typecho/Common.php:537`

public static function safeUrl($url)
{
    $params = parse_url(str_replace(["\r", "\n", "\t", ' '], '', $url));

    if (isset($params['scheme'])) {
        if (!in_array($params['scheme'], ['http', 'https'])) {
            return '/';
        }
    }
    // strips ", ', <, > and a few other XSS-ish bytes from each URL part
    // ...
    return self::buildUrl($params);
}

safeUrl only restricts the scheme to http/https and strips
characters that could break out of an HTML attribute (", ', <, >).
It does not validate the host. So https://evil.example/anything
survives safeUrl unchanged.

Proof of concept

Attacker page (`https://evil.example/phish.html`)

<!doctype html>
<a href="https://victim.example/index.php/action/login">
  Continue to victim.example login
</a>

Steps

Victim browses to https://evil.example/phish.html and clicks the link.
The browser navigates to
https://victim.example/index.php/action/login with
Referer: https://evil.example/phish.html.
Widget\Action::execute dispatches to Widget\Login::action.
$this->security->protect() runs. The request has no _ parameter, so
the token comparison fails.
protect() calls $this->response->goBack().
goBack() reads Referer: https://evil.example/phish.html, passes it
to redirect(), which passes it to safeUrl(). The scheme is https,
so safeUrl returns it unchanged.
The server responds with
302 Location: https://evil.example/phish.html.

Repro with `curl`

$ curl -s -o /dev/null -D - \
       -H 'Referer: https://evil.example/anything' \
       'https://victim.example/index.php/action/login'

HTTP/2 302
location: https://evil.example/anything

The redirect fires unauthenticated.

snoopysecurity changed the title ~~dont use referrer based based open redirect in Response::goBack~~ Validate Referer host before redirecting in Response::goBack May 17, 2026

Validate Referer host before redirecting in Response::goBack

e7e79c4

snoopysecurity force-pushed the master branch from 25e6ec0 to e7e79c4 Compare May 17, 2026 22:56

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Validate Referer host before redirecting in Response::goBack#1980

Validate Referer host before redirecting in Response::goBack#1980
snoopysecurity wants to merge 1 commit into
typecho:masterfrom
snoopysecurity:master

snoopysecurity commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Conversation

snoopysecurity commented May 15, 2026

Summary of security issue

Summary of fix

More information regarding the security issue

1. Widget\Security::protect() — var/Widget/Security.php:63

2. Typecho\Widget\Response::goBack() — var/Typecho/Widget/Response.php:187

3. Typecho\Widget\Response::redirect() — line 172

4. Common::safeUrl() — var/Typecho/Common.php:537

Proof of concept

Attacker page (https://evil.example/phish.html)

Steps

Repro with curl

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. `Widget\Security::protect()` — `var/Widget/Security.php:63`

2. `Typecho\Widget\Response::goBack()` — `var/Typecho/Widget/Response.php:187`

3. `Typecho\Widget\Response::redirect()` — line 172

4. `Common::safeUrl()` — `var/Typecho/Common.php:537`

Attacker page (`https://evil.example/phish.html`)

Repro with `curl`