Barracuda SSL VPN 680 'returnTo' Parameter Open Redirection Vulnerability

Bugtraq ID:	60172
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2013 12:00AM
Updated:	Mar 19 2015 09:09AM
Credit:	Chokri Ben Achour of Vulnerability Laboratory and Dave Farrow of Barracuda Networks
Vulnerable:
Not Vulnerable:

Barracuda SSL VPN 680 'returnTo' Parameter Open Redirection Vulnerability

Barracuda SSL VPN 680 is prone to an open-redirection vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Barracuda SSL VPN 680 2.2.2.203 is vulnerable; other versions may also be affected.

Barracuda SSL VPN 680 'returnTo' Parameter Open Redirection Vulnerability

Attackers can exploit this issue through a browser.

The following example URIs are available:

https://www.example.com/launchApplication.do?resourceId=1&policy=1&returnTo=%2FshowApplicationShortcuts.do
https://www.exmaple.com/launchApplication.do?resourceId=1&policy=1&returnTo=http://www.example.com
https://www.exmaple.com/[FILE].do?[RES+ID]=x&[POLICY]=x&returnTo=[EXTERNAL TARGET]

Barracuda SSL VPN 680 'returnTo' Parameter Open Redirection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Barracuda SSL VPN 680 'returnTo' Parameter Open Redirection Vulnerability

References:

• Barracuda SSL VPN 680 2.2.2.203 - Redirect Vulnerability (Vulnerability Laboratory)
  
• Barracuda SSL VPN Homepage (Barracuda Networks)