CVE-2024-21723: Joomla! Open Redirect Vulnerability

CVE-2024-21723 Overview

CVE-2024-21723 is an open redirect vulnerability in the Joomla! content management system. Inadequate URL parsing within the installation application allows attackers to craft links that redirect users to attacker-controlled destinations. The flaw is tracked under CWE-601: URL Redirection to Untrusted Site and requires user interaction to succeed.

Joomla assigned the issue in Joomla Security Advisory #926. Successful exploitation supports phishing and credential harvesting because the redirect appears to originate from a trusted Joomla domain.

Critical Impact
Attackers can weaponize trusted Joomla URLs to redirect users to malicious sites, enabling phishing campaigns and social engineering attacks against site visitors.

Affected Products

Joomla! CMS installations covered by Joomla Security Advisory #926
The installation application component of Joomla! core
Deployments that retain the installation application after setup

Discovery Timeline

2024-02-29 - CVE-2024-21723 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21723

Vulnerability Analysis

The vulnerability resides in the installation application of Joomla! core. URL parsing logic fails to validate that redirect targets belong to the local application. Attackers supply a crafted URL parameter that the application accepts as a redirect destination without domain allow-listing.

The issue is categorized under CWE-601: URL Redirection to Untrusted Site, commonly known as an open redirect. Impact is limited to integrity of the client session because no confidentiality or availability loss occurs on the server. The flaw requires the victim to click a crafted link, so exploitation depends on social engineering.

Root Cause

The installation application parses URL input without verifying that the target host matches the application's own domain. Missing validation on the redirect parameter allows arbitrary external URLs to be honored. Joomla addressed this by tightening URL parsing within the affected installer component per the vendor advisory.

Attack Vector

An attacker crafts a Joomla URL that includes a redirect parameter pointing to an attacker-controlled site. The attacker delivers the link through email, chat, or a malicious page. When the victim clicks the link, the Joomla installation application processes it and issues an HTTP redirect to the attacker's destination. The victim's browser navigates to a phishing page that visually mimics the legitimate site.

Code examples are not published for this issue. Refer to Joomla Security Advisory #926 for vendor-supplied technical details.

Detection Methods for CVE-2024-21723

Indicators of Compromise

HTTP requests to Joomla installation endpoints containing redirect parameters that reference external hostnames
Web server access logs showing 3xx responses from installer paths to non-local Location headers
Referrer chains where users land on unfamiliar domains immediately after visiting a legitimate Joomla URL

Detection Strategies

Inspect web application firewall (WAF) logs for query strings containing fully qualified URLs pointing to third-party domains within Joomla installer routes
Alert on the continued presence of the installation directory on production Joomla hosts, which should be removed after setup
Correlate phishing report telemetry with outbound clicks originating from Joomla-hosted URLs

Monitoring Recommendations

Enable verbose access logging on Joomla web servers and forward logs to a centralized analytics platform for query-string inspection
Monitor Joomla core version inventories to identify hosts running versions covered by Joomla Security Advisory #926
Track user-reported phishing incidents that reference the organization's Joomla domains as the initial landing page

How to Mitigate CVE-2024-21723

Immediate Actions Required

Upgrade Joomla! to the fixed release identified in Joomla Security Advisory #926
Remove the installation directory from any production Joomla deployment where setup has completed
Review WAF rules to block redirect parameters that contain external URLs on installer endpoints

Patch Information

Joomla published the fix in Joomla Security Advisory #926. Administrators should apply the corresponding Joomla core update through the built-in updater or by deploying the patched package. Verify the running version after upgrade using the Joomla administrator dashboard.

Workarounds

Delete the installation folder immediately after Joomla setup completes to eliminate the vulnerable code path
Restrict access to installer paths at the web server or reverse proxy layer using IP allow-lists
Deploy WAF signatures that reject requests containing external URLs in redirect-related query parameters

bash

# Remove the installation directory after setup completes
rm -rf /var/www/html/installation

# Example nginx block to deny access to installer paths
location ^~ /installation/ {
    deny all;
    return 404;
}