ZZ00481: APPLICATIONS ACCEPT A URL AS A QUERY STRING PARAMETER AND PERFORM A REDIRECT BASED ON THE URL ARE OPEN TO ABUSE

IBM Cloud Orchestrator Fix Pack 3 (2.4.0.3) for 2.4

APAR status

• Closed as fixed if next.

Error description

• Applications accept a URL as a query string parameter and
  perform a redirect based on the URL are open to abuse. An
  attacker can abuse this by sending a user a link that appears
  to go to a trusted location but instead goes to an attacker
  controlled location.
  URL examples:
  https://<host>/ico/login?page=<openRedirectVulnerableValue>
  https://<host>/switchprotject?...&menu_path=<openRedirectVulnera
  bleValue>&...
  

Local fix

• n/a
  

Problem summary

• The application redirects to user
  supplied URL parameters in several
  locations. Both issues affect all users of the application.
  
  I have provided fix for URL redirction issue, which will
  avaiable for ICO v 2.4.0.3
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• R240 PSY

     UP