CVE-2025-0705: Joeybling Bootplus Open Redirect Flaw

CVE-2025-0705 Overview

CVE-2025-0705 is an open redirect vulnerability in JoeyBling bootplus, an open-source Spring Boot management platform. The flaw resides in the qrCode function of src/main/java/io/github/controller/QrCodeController.java. Manipulation of the text argument allows an attacker to redirect users to arbitrary external destinations. The attack is exploitable remotely without authentication or user interaction beyond clicking a crafted link. Because bootplus follows a rolling-release model, no fixed version identifier is available, and the vulnerable state extends up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. The issue is tracked under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can craft URLs pointing to trusted bootplus instances that transparently redirect victims to attacker-controlled domains, enabling phishing, credential theft, and malware delivery campaigns.

Affected Products

JoeyBling bootplus up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d
Component: src/main/java/io/github/controller/QrCodeController.java
All rolling releases prior to the applied fix

Discovery Timeline

2025-01-24 - CVE-2025-0705 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0705

Vulnerability Analysis

The vulnerability exists in the QR code generation endpoint of the bootplus application. The qrCode function accepts a user-supplied text parameter that is used to construct a redirect response without proper validation or allow-list enforcement. When a victim clicks a link containing an attacker-crafted text value, the server issues an HTTP redirect to the specified destination.

The exploit has been publicly disclosed through the project's GitHub issue tracker, increasing the likelihood of opportunistic abuse. The vulnerability requires no authentication and can be launched over the network with low attack complexity.

Root Cause

The root cause is missing input validation on the text parameter within QrCodeController.java. The controller trusts user-controlled input to define a redirect target, violating the safe URL redirect principle described in [CWE-601]. There is no allow-list of permitted hosts, no relative-URL enforcement, and no verification that the destination belongs to the application's own domain.

Attack Vector

An attacker crafts a URL pointing to the bootplus QR code endpoint with a malicious value in the text parameter, for example a link that appears to originate from the legitimate bootplus host but redirects to an attacker-controlled phishing page. The attacker distributes this link via email, chat, or social media. Victims see the trusted domain in the initial URL and are more likely to trust the redirected destination. This technique is commonly chained with credential phishing kits and malware download landing pages. Further technical details are documented in the GitHub Issue #27 and VulDB entry #293233.

Detection Methods for CVE-2025-0705

Indicators of Compromise

Web server access logs showing requests to the QR code endpoint with external URLs in the text query parameter
HTTP 302/301 responses from bootplus endpoints redirecting to domains outside the application's expected scope
Referrer headers on downstream systems indicating traffic originated from a bootplus host but transitioned to unrelated domains

Detection Strategies

Inspect application access logs for the qrCode endpoint and flag text parameters containing http://, https://, //, or URL-encoded scheme prefixes
Deploy web application firewall (WAF) rules that block requests where redirect parameters reference external hostnames
Correlate outbound user traffic with proxy logs to identify redirect chains originating from bootplus deployments

Monitoring Recommendations

Enable verbose HTTP logging on bootplus instances, capturing full query strings for the QR code controller
Alert on anomalous spikes in requests to the qrCode endpoint that may indicate a phishing campaign in progress
Monitor threat intelligence feeds for phishing URLs abusing legitimate bootplus deployments as redirect launchpads

How to Mitigate CVE-2025-0705

Immediate Actions Required

Update bootplus to a commit later than 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d that contains the fix
Restrict public exposure of the QR code endpoint until validation logic is confirmed in place
Audit application logs for prior exploitation attempts referencing external URLs in the text parameter

Patch Information

Bootplus uses a rolling-release model, so no versioned patch identifier is published. Administrators should pull the latest upstream code from the JoeyBling/bootplus repository and confirm that QrCodeController.java validates the text parameter before use. Track the remediation discussion in GitHub Issue #27.

Workarounds

Implement a server-side allow-list of permitted redirect destinations and reject any text value referencing external hosts
Deploy a reverse-proxy rule that strips or rewrites the text parameter when it contains absolute URLs
Add a warning interstitial page that displays the destination URL before performing any redirect, giving users a chance to abort

bash

# Example nginx rule to block external URLs in the text parameter
location /qrCode {
    if ($arg_text ~* "^(https?:)?//") {
        return 403;
    }
    proxy_pass http://bootplus_backend;
}