CVE-2025-0970 Overview
CVE-2025-0970 is an open redirect vulnerability affecting Zenvia Movidesk versions up to 25.01.22. The flaw resides in the /Account/Login endpoint, where the ReturnUrl parameter accepts attacker-controlled destinations without proper validation. An unauthenticated remote attacker can craft a malicious login URL that redirects victims to an external site after interacting with the legitimate Movidesk domain. The vulnerability is tracked under CWE-601: URL Redirection to Untrusted Site. Zenvia addressed the issue in version 25.01.22.245a473c54. Public disclosure of the exploit details has occurred through VulDB entry #294361.
Critical Impact
Attackers can leverage the trusted Movidesk login domain to redirect users to phishing sites, harvesting credentials or delivering malware while bypassing user suspicion.
Affected Products
- Zenvia Movidesk versions up to and including 25.01.22
- The /Account/Login endpoint accepting the ReturnUrl parameter
- Deployments running builds prior to 25.01.22.245a473c54
Discovery Timeline
- 2025-02-02 - CVE-2025-0970 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0970
Vulnerability Analysis
The vulnerability is a classic open redirect flaw in the authentication workflow of Zenvia Movidesk. When a user accesses /Account/Login, the application accepts a ReturnUrl query parameter that dictates where the browser navigates after successful authentication. The application does not verify that the supplied URL points to an in-scope host or a whitelisted path. As a result, an attacker can supply an arbitrary absolute URL and cause the application to redirect authenticated or unauthenticated users to any external location.
This category of flaw is mapped to CWE-601. While the confidentiality and availability impacts on the application itself are limited, the integrity impact on end users is meaningful. The attack requires no privileges and no direct interaction with the target system beyond convincing a user to click a crafted URL.
Root Cause
The root cause is missing validation of the ReturnUrl parameter. The login handler treats the value as a trusted redirect target rather than restricting it to relative paths or a domain allowlist. Without host or scheme checks, the parameter accepts external URLs such as https://attacker.example.
Attack Vector
An attacker crafts a URL of the form https://<victim-movidesk-instance>/Account/Login?ReturnUrl=https://attacker.example/phish and delivers it through email, chat, or search engine poisoning. The victim sees a legitimate Movidesk domain in the initial link and proceeds. After the login flow completes, the browser is redirected to the attacker-controlled site, which typically mimics the Movidesk login page to capture credentials or delivers a malicious payload.
No authentic exploit code has been released. See the VulDB advisory for further technical details.
Detection Methods for CVE-2025-0970
Indicators of Compromise
- HTTP requests to /Account/Login containing a ReturnUrl parameter whose value is an absolute URL pointing outside the Movidesk domain
- Referrer headers from Movidesk login pages leading to unfamiliar external domains
- User reports of unexpected redirects after logging into the helpdesk portal
Detection Strategies
- Parse web server or reverse proxy logs for ReturnUrl values containing http:// or https:// schemes and hostnames outside the organization
- Correlate login events with outbound HTTP referrers to identify redirect chains to suspicious domains
- Deploy web application firewall (WAF) rules that flag or block absolute URLs in the ReturnUrl parameter
Monitoring Recommendations
- Alert on newly registered look-alike domains impersonating the organization's Movidesk tenant
- Monitor phishing feeds and threat intelligence sources for URLs referencing the affected Movidesk endpoint
- Track authentication anomalies such as unusual geolocations or credential reuse that may follow a successful phishing redirect
How to Mitigate CVE-2025-0970
Immediate Actions Required
- Upgrade Zenvia Movidesk to version 25.01.22.245a473c54 or later
- Audit existing login URLs shared in tickets, emails, and documentation for tampered ReturnUrl values
- Educate helpdesk users to inspect the address bar after authentication and report unexpected redirects
Patch Information
Zenvia has released a fixed build identified as 25.01.22.245a473c54. Administrators should apply this update through the standard Movidesk update channel. Refer to VulDB #294361 for the vendor patch reference and confirm the running version after the upgrade.
Workarounds
- Configure the reverse proxy or WAF to reject requests to /Account/Login where ReturnUrl contains an absolute URL or a scheme prefix
- Restrict ReturnUrl handling to relative paths only through a URL rewrite rule until the patch is applied
- Add strict Content Security Policy (CSP) and referrer policies to reduce the value of a successful redirect to an attacker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
