Web flaw · Scan + Code · first seen 1 Oct
MediumConfirmed exploitableOpenPaymentsfix by 30 Nov
Last seen by a scan that could see it · Deep scan of tessellatepay.com, Thu 1 Oct
Standard scan of tessellatepay.com, Mon 5 Oct couldn't test for it properly, so it stays open. Only a complete scan of the same depth can close it.
One problem in two places, found two ways. Proven in one.
2 sources · 2 places
Scan
First found Thu 1 Oct
Code
ts/open-redirect
It closes only when all of these are true
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
17th of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
56 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Proven in last month's Deep scan: sign-in sends people on to any address in ?next=. A phishing link can start on your real sign-in page.
Proof
The payload went in and came back as the attack needs it to.
What we saw
Parameter next, payload //evil.example/
HTTP/2 307 · location: //evil.example/
The fix
Only accept relative paths in next, or check it against a list of your own hosts.
Where
The code · tessellate/web
Open the repositoryapps/dashboard/src/app/sign-in/actions.ts
| 24 | const session = await signIn(form); |
| 25 | if (!session) return { error: "Wrong email or password" }; |
| 26 | const next = form.get("next")?.toString() ?? "/"; |
| 27 | redirect(next); |
| 28 | } |
Where the data goes
The fix
Only accept a path that starts with a single / (not //), or check the host against a list of yours.
What happened, and what was said
1 event · 0 comments · oldest first