CVE-2024-49706: Softcom.wroc Iksoris Open Redirect Vulnerability

CVE-2024-49706 Overview

CVE-2024-49706 is an open redirect vulnerability in the Internet Starter module of the SoftCOM iKSORIS system. The flaw allows attackers to redirect users to attacker-controlled destinations by embedding base64-encoded URLs in the target parameter of a POST request. The weakness is tracked under CWE-601: URL Redirection to Untrusted Site. SoftCOM addressed the issue in version 79.0 of the affected module. iKSORIS is a Polish ticketing and reservation platform used by cultural and recreational venues, according to the IKSORIS product overview.

Critical Impact
Attackers can craft links that appear to originate from a trusted iKSORIS-hosted domain but redirect victims to phishing or malware-hosting sites, enabling credential theft and social engineering.

Affected Products

SoftCOM iKSORIS Internet Starter module prior to version 79.0
Deployments identified by CPE cpe:2.3:a:softcom.wroc:iksoris:*:*:*:*:*:*:*:*
Public-facing iKSORIS ticketing and reservation endpoints exposing the vulnerable POST handler

Discovery Timeline

2025-04-14 - CVE-2024-49706 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49706

Vulnerability Analysis

The Internet Starter module accepts a target parameter in a POST request to one of its endpoints. The value is a base64-encoded URL that the application decodes and uses to issue an HTTP redirect. The application does not validate whether the decoded URL points to an allowed host before performing the redirect. As a result, an attacker can supply any external URL and force the server to redirect authenticated or unauthenticated users to it.

Open redirects are frequently chained with phishing campaigns. Because the initial link originates from a legitimate iKSORIS domain, email gateways and users are more likely to trust it. The base64 encoding of the payload further obscures the final destination during casual link inspection, reducing the effectiveness of URL-based filtering.

User interaction is required for exploitation, as the victim must click or submit the crafted request. There is no impact to confidentiality or integrity of the vulnerable application itself, but downstream systems and end users bear the risk.

Root Cause

The root cause is missing allow-list validation of the decoded target parameter before the server issues the redirect response. The application trusts client-supplied input to determine the redirect destination, matching the pattern described in CWE-601.

Attack Vector

An attacker base64-encodes a malicious URL and embeds it in the target field of a POST request to the vulnerable Internet Starter endpoint. The attacker then distributes a link or form that submits this request from a victim's browser. Upon receiving the request, the server decodes the parameter and returns a redirect response pointing the victim to the attacker's destination. Additional technical context is available in the CERT Polska advisory.

// No verified proof-of-concept code has been published.
// Vulnerable flow (conceptual):
// 1. Attacker builds redirect_url = base64_encode("https://attacker.example/phish")
// 2. Attacker crafts POST /vulnerable-endpoint with body: target=<redirect_url>
// 3. Server decodes target and issues HTTP 302 Location: https://attacker.example/phish

Detection Methods for CVE-2024-49706

Indicators of Compromise

Web server access logs showing POST requests to Internet Starter endpoints containing a target parameter with base64-encoded values
HTTP 3xx responses whose Location header points to external, non-iKSORIS domains
Referer headers on downstream phishing landing pages that trace back to the organization's iKSORIS host

Detection Strategies

Parse web access logs for target= parameters, base64-decode the values, and flag those resolving to domains outside an approved allow-list
Correlate outbound redirects from iKSORIS hosts with threat-intelligence feeds for newly registered or known-malicious domains
Deploy a web application firewall (WAF) rule that inspects and decodes the target parameter and blocks unapproved destinations

Monitoring Recommendations

Alert on spikes in redirect responses from iKSORIS endpoints, especially outside business hours
Monitor email gateway telemetry for inbound messages containing URLs that reference the vulnerable endpoint
Track user reports of unexpected redirects originating from links to the ticketing portal

How to Mitigate CVE-2024-49706

Immediate Actions Required

Upgrade the SoftCOM iKSORIS Internet Starter module to version 79.0 or later
Inventory all internet-facing iKSORIS deployments and confirm the patched version is installed
Review recent web logs for suspicious target parameter values that may indicate active abuse

Patch Information

SoftCOM has patched the vulnerability in version 79.0 of the Internet Starter module. The CERT Polska advisory coordinates disclosure of related iKSORIS issues and confirms the fixed version. No vendor-hosted advisory URL is currently listed in the NVD record.

Workarounds

Configure a reverse proxy or WAF to strip or reject requests containing the target parameter on the affected endpoint until patching is complete
Implement server-side allow-listing so that only URLs matching approved internal hostnames are accepted for redirection
Display an interstitial warning page for any outbound redirect, requiring explicit user confirmation before leaving the trusted domain

bash

# Example nginx snippet: block requests carrying a base64-encoded target parameter
# until the Internet Starter module is upgraded to version 79.0
location /internet-starter/ {
    if ($arg_target != "") {
        return 403;
    }
    proxy_pass http://iksoris_backend;
}