CVE-2025-10229: Freshwork Open Redirect Vulnerability

CVE-2025-10229 Overview

CVE-2025-10229 is an open redirect vulnerability affecting Freshwork versions up to and including 1.2.3. The flaw resides in the /api/v2/logout endpoint, where the post_logout_redirect_uri parameter is not properly validated before redirection. An unauthenticated remote attacker can craft a URL that redirects users to an attacker-controlled destination after logout. The exploit has been publicly disclosed, increasing the likelihood of use in phishing and credential-harvesting campaigns. According to VulDB, the vendor was contacted about this disclosure but did not respond. The weakness is tracked under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can weaponize the trusted Freshwork domain in phishing lures, redirecting authenticated users to malicious sites after logout to harvest credentials or deliver malware.

Affected Products

Freshwork versions up to 1.2.3
Component: /api/v2/logout endpoint
Parameter: post_logout_redirect_uri

Discovery Timeline

2025-09-10 - CVE-2025-10229 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10229

Vulnerability Analysis

The vulnerability is an unvalidated redirect on the logout flow of the Freshwork application. When a client calls /api/v2/logout, the server honors the post_logout_redirect_uri query parameter and issues an HTTP redirect to whatever value the caller supplies. The endpoint does not restrict the target to a whitelist of trusted hosts or verify that the destination shares the application origin. Because logout endpoints are commonly linked from legitimate emails and in-app notifications, users perceive the initial URL as trustworthy. The EPSS score is 0.304% at the 22nd percentile, indicating limited but non-zero real-world exploitation probability.

Root Cause

The root cause is missing input validation on the post_logout_redirect_uri parameter. The logout handler treats the parameter as a trusted string and passes it directly to the redirect response builder. There is no allowlist check, no same-origin comparison, and no cryptographic binding between the redirect target and the initiating session.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker constructs a URL such as https://<freshwork-host>/api/v2/logout?post_logout_redirect_uri=https://attacker.example/phish and distributes it through email, chat, or malicious sites. When the victim clicks the link, Freshwork logs them out and redirects the browser to the attacker page, which frequently mimics the Freshwork login screen to capture re-entered credentials. No authentication, privileges, or exploit code beyond a crafted URL is required.

See the VulDB entry #323487 and the associated technical write-up for the disclosed proof of concept.

Detection Methods for CVE-2025-10229

Indicators of Compromise

Requests to /api/v2/logout containing a post_logout_redirect_uri value pointing to an external domain
HTTP 30x responses from the Freshwork host with Location headers referencing non-corporate domains
Referrer logs on downstream systems showing traffic originating from the Freshwork logout endpoint
Reports of phishing emails whose links begin with the legitimate Freshwork hostname

Detection Strategies

Deploy web application firewall rules that inspect the post_logout_redirect_uri parameter and block values not matching an approved host allowlist
Correlate outbound redirects from Freshwork with newly registered or low-reputation domains using threat intelligence feeds
Alert on any logout request where the redirect target host differs from the request Host header

Monitoring Recommendations

Enable verbose access logging on the Freshwork reverse proxy to capture full query strings on /api/v2/logout calls
Forward logs to a centralized SIEM and build a dashboard tracking distinct redirect destinations over time
Monitor user reports and email gateway telemetry for phishing lures abusing the Freshwork domain

How to Mitigate CVE-2025-10229

Immediate Actions Required

Upgrade Freshwork to a patched release beyond 1.2.3 once the vendor publishes a fix
Place a reverse proxy or WAF rule in front of /api/v2/logout to strip or validate the post_logout_redirect_uri parameter
Educate users to inspect the final destination URL after logout and to report unexpected redirects

Patch Information

The VulDB advisory states that upgrading to version 1.2.3 addresses the issue; however, the CVE description also lists 1.2.3 as affected, indicating the fix may be delivered in a later release. Because the vendor has not responded to disclosure requests, administrators should verify the running build and consult the VulDB CTI record for updates.

Workarounds

Configure the front-end proxy to enforce an allowlist of permitted post-logout destinations, rejecting any request whose redirect target is not on the list
Rewrite the post_logout_redirect_uri value to a static internal URL until an official patch is available
Add HTTP response header inspection to drop Location headers pointing to external hosts on the logout route

bash

# Example NGINX snippet to neutralize the open redirect
location = /api/v2/logout {
    if ($arg_post_logout_redirect_uri !~* "^https://(www\.)?freshwork\.example(/|$)") {
        return 302 https://freshwork.example/;
    }
    proxy_pass http://freshwork_backend;
}