CVE-2024-45247: Sonarr Open Redirect Vulnerability

CVE-2024-45247 Overview

CVE-2024-45247 is an open redirect vulnerability in Sonarr, a personal video recorder application for Usenet and BitTorrent users. The flaw falls under CWE-601: URL Redirection to Untrusted Site. Attackers can craft URLs that appear to originate from a trusted Sonarr instance but redirect victims to attacker-controlled destinations. The vulnerability requires user interaction to trigger successful exploitation.

Critical Impact
Attackers can leverage this open redirect to conduct phishing campaigns, deliver malicious payloads, or bypass URL-based security controls by chaining redirects through a legitimate Sonarr host.

Affected Products

Sonarr (personal video recorder application)
Product version details not specified in the NVD entry
Consult the vendor advisory for exact affected releases

Discovery Timeline

2024-10-06 - CVE-2024-45247 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45247

Vulnerability Analysis

The vulnerability stems from insufficient validation of user-supplied URL parameters used in redirect operations. Sonarr accepts a target URL and issues an HTTP redirect without verifying that the destination belongs to an allowlisted domain. This behavior lets an attacker construct a link that appears legitimate to end users and security filters.

The redirect occurs in the browser after the victim clicks the crafted link. Because the initial hostname belongs to a trusted Sonarr instance, email gateways and web proxies that inspect only the first hop may permit the traffic. The final destination can host phishing pages, credential harvesting forms, or drive-by download content.

User interaction is required, which limits mass exploitation. The scope change indicates that a successful attack affects resources beyond the vulnerable Sonarr instance. Both confidentiality and integrity impacts are limited because the flaw does not expose Sonarr data directly.

Root Cause

The root cause is missing or improper validation of a redirect target parameter. The application trusts client-supplied input when constructing the Location response header. Without an allowlist of permitted hosts or a signed redirect token, arbitrary external URLs are accepted.

Attack Vector

An attacker crafts a URL pointing to the vulnerable Sonarr endpoint with an attacker-controlled destination embedded as a query parameter. The attacker distributes the link through email, chat, or social media. When the victim clicks the link, Sonarr responds with an HTTP 3xx redirect to the malicious site, effectively laundering the request through a trusted origin.

The vulnerability mechanism is described in the Israeli Government CVE Advisories reference. No public proof-of-concept exploit has been published as of this writing.

Detection Methods for CVE-2024-45247

Indicators of Compromise

Outbound HTTP 3xx responses from Sonarr endpoints containing external URLs in the Location header
Web proxy logs showing user clicks on Sonarr URLs immediately followed by requests to unrelated external domains
Referrer headers on suspicious external sites pointing back to internal Sonarr instances

Detection Strategies

Inspect Sonarr access logs for redirect endpoints receiving requests with URL-encoded external hostnames in query parameters
Deploy web application firewall rules that flag redirect responses where the Location header host differs from the Sonarr domain
Correlate email gateway click-tracking data with subsequent redirect chains originating from trusted Sonarr URLs

Monitoring Recommendations

Enable verbose HTTP logging on reverse proxies fronting Sonarr to capture full request URIs and response headers
Alert on abnormal volumes of redirect responses from Sonarr instances, which may indicate active phishing campaigns
Monitor DNS and proxy telemetry for user traffic originating from Sonarr referrers to newly registered or low-reputation domains

How to Mitigate CVE-2024-45247

Immediate Actions Required

Apply the latest Sonarr security update as soon as the vendor publishes a patched release
Restrict Sonarr access to trusted internal networks or place it behind an authenticated reverse proxy
Educate users to inspect the final destination of any Sonarr-originated link before entering credentials

Patch Information

Refer to the Israeli Government CVE Advisories reference for advisory details. Administrators should upgrade to the latest Sonarr version and monitor the project's release notes for the fix commit addressing the open redirect.

Workarounds

Configure the reverse proxy or web application firewall to strip or validate redirect parameters targeting external hosts
Enforce an allowlist of permitted redirect destinations at the network edge
Disable public exposure of Sonarr management endpoints where feasible

bash

# Example NGINX rule to block external redirects from Sonarr responses
location / {
    proxy_pass http://sonarr_backend;
    proxy_hide_header Location;
    add_header Location $upstream_http_location;
    if ($upstream_http_location !~ "^https?://sonarr\.example\.com/") {
        return 403;
    }
}