CVE-2025-10355: MOLGENIS EMX2 Open Redirect Vulnerability

CVE-2025-10355 Overview

CVE-2025-10355 is an open redirection vulnerability affecting MOLGENIS EMX2 version 11.14.0. The flaw resides in a redirection parameter that fails to validate user-supplied URL input. Attackers can craft a malicious URL using the pattern /%2f%2f<MALICIOUS_DOMAIN> to redirect users from the legitimate EMX2 origin to attacker-controlled destinations. This weakness maps to CWE-601: URL Redirection to Untrusted Site and enables phishing, credential harvesting, and malware delivery campaigns that leverage the trusted EMX2 domain.

Critical Impact
Attackers can weaponize legitimate MOLGENIS EMX2 URLs to redirect authenticated users to phishing pages, undermining domain trust and enabling credential theft.

Affected Products

MOLGENIS EMX2 v11.14.0
Deployments exposing the vulnerable redirection parameter to network users
Any hosted EMX2 research data platform instance running the affected build

Discovery Timeline

2025-10-23 - CVE-2025-10355 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10355

Vulnerability Analysis

MOLGENIS EMX2 is an open-source platform used to publish and manage biomedical research data. Version 11.14.0 accepts a redirection parameter that does not enforce an allowlist of internal destinations. An attacker who supplies a URL of the form /%2f%2f<MALICIOUS_DOMAIN> bypasses naive same-origin checks. The double URL-encoded forward slashes (%2f%2f) are decoded by the application into //, which browsers interpret as a protocol-relative external URL. The user's browser follows the redirect to the attacker's domain while the original request appears to originate from the trusted EMX2 host.

The attack requires user interaction: a victim must click a crafted link delivered through email, chat, or a compromised web page. No authentication is required to construct or trigger the redirect. Because the initial URL carries a legitimate MOLGENIS EMX2 hostname, security-aware users and URL-inspection tools are more likely to trust the link.

Root Cause

The root cause is insufficient validation of the redirection target parameter. The application decodes the URL-encoded payload and issues an HTTP redirect without confirming that the resulting destination matches an approved internal path or host. Encoded slash sequences bypass simple string checks that only look for literal http:// or // prefixes.

Attack Vector

An attacker crafts a URL such as https://<trusted-emx2-host>/<endpoint>?redirect=/%2f%2fattacker.example. The victim receives the link in a phishing message. Upon clicking, the EMX2 server processes the parameter, decodes %2f%2f to //, and issues an HTTP 302 response with Location: //attacker.example. The browser resolves the protocol-relative URL against the current scheme and navigates the user to the attacker's site. The attacker's landing page typically imitates the EMX2 login screen to capture credentials or delivers a drive-by download.

No verified proof-of-concept code has been published. See the INCIBE Notice on Open Redirection Vulnerability for advisory details.

Detection Methods for CVE-2025-10355

Indicators of Compromise

HTTP requests to EMX2 endpoints containing %2f%2f, %2F%2F, or double-encoded variants such as %252f%252f in query parameters
Redirect responses (HTTP 301, 302, 303, 307) with Location headers pointing to external domains not on an internal allowlist
Referrer logs on external domains showing incoming traffic from the legitimate EMX2 host paired with unusual query strings
Phishing reports from users describing links that originated from the trusted MOLGENIS EMX2 domain

Detection Strategies

Deploy web application firewall (WAF) rules that flag encoded slash sequences in redirection parameters targeting EMX2 endpoints
Parse EMX2 access logs to identify parameter values beginning with /, \, //, or their encoded equivalents followed by hostnames
Correlate outbound redirect responses with destination domains that fall outside the organization's approved list
Use URL reputation feeds to score external domains referenced in EMX2 redirect traffic

Monitoring Recommendations

Enable verbose HTTP access logging on EMX2 reverse proxies to capture full query strings and Location response headers
Alert when redirect parameters contain URL-encoded characters, protocol-relative slashes, or @ symbols used for authority confusion
Baseline normal redirect targets for EMX2 and generate an alert on any deviation to a new external host

How to Mitigate CVE-2025-10355

Immediate Actions Required

Inventory all MOLGENIS EMX2 deployments and identify instances running version 11.14.0
Restrict access to EMX2 redirection endpoints from untrusted networks until a fix is deployed
Notify users of the phishing risk and instruct them to inspect the full destination of EMX2 links before entering credentials
Monitor the INCIBE advisory and the MOLGENIS project for patch availability

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry. Administrators should track the MOLGENIS EMX2 project for a fixed release beyond version 11.14.0 and apply updates as soon as they are available.

Workarounds

Add a WAF or reverse proxy rule that rejects requests where the redirect parameter contains %2f%2f, %5c%5c, //, or backslash sequences
Implement an allowlist at the proxy layer that only permits redirects to hostnames matching the EMX2 deployment
Strip or normalize URL-encoded slashes in query parameters before requests reach the EMX2 application
Configure Content Security Policy (CSP) and browser-side referrer controls to reduce the value of a successful redirect for phishing follow-up

bash

# Example NGINX rule to block encoded double-slash in redirect parameters
if ($args ~* "(redirect|url|next|return)=(%2f%2f|%252f%252f|//)") {
    return 400;
}