CVE-2025-11222: Central Dogma Open Redirect Vulnerability

CVE-2025-11222 Overview

CVE-2025-11222 is an Open Redirect vulnerability [CWE-601] affecting LINE Corporation's Central Dogma versions prior to 0.78.0. The flaw allows attackers to craft URLs that redirect authenticated users to attacker-controlled destinations. Central Dogma is a highly-available service configuration repository used to manage application configurations at scale.

Attackers exploit the vulnerability by delivering specially crafted URLs through phishing campaigns, chat applications, or email. When a user clicks the link, the Central Dogma application redirects them to an untrusted external site. This behavior facilitates credential theft and further social engineering.

Critical Impact
Attackers can leverage the trusted Central Dogma domain to redirect users to phishing sites, capturing credentials and session material.

Affected Products

LINE Corporation Central Dogma versions before 0.78.0
Deployments using Central Dogma as a configuration repository service
Applications relying on Central Dogma web interfaces for administration

Discovery Timeline

2025-12-04 - CVE-2025-11222 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11222

Vulnerability Analysis

CVE-2025-11222 is classified as an Open Redirect under [CWE-601]: URL Redirection to Untrusted Site. The vulnerability resides in URL handling logic within Central Dogma versions before 0.78.0. The application accepts a user-controlled parameter that specifies a redirect target without validating it against an allowlist of trusted destinations.

Exploitation requires user interaction. An attacker must convince a target to click a crafted link pointing to the legitimate Central Dogma host. Because the initial URL originates from a trusted domain, users and email security gateways are more likely to trust the request. The redirect then delivers the victim to an attacker-controlled site.

The impact is limited to confidentiality and integrity within the browser context. Availability of the Central Dogma service itself is not affected. However, downstream phishing pages can harvest credentials, session tokens, or OAuth authorization codes if the target application chains authentication flows through the redirect.

Root Cause

The root cause is insufficient validation of redirect target parameters in HTTP responses issued by Central Dogma. The service accepts arbitrary URLs and returns HTTP responses that navigate the browser to the supplied destination. Version 0.78.0 introduces validation logic that restricts redirect targets to same-origin or explicitly allowlisted destinations.

Attack Vector

The attack vector is network-based and requires user interaction. An adversary constructs a URL such as https://<centraldogma-host>/<vulnerable-path>?redirect=https://attacker.example. The victim receives the link through phishing, instant messaging, or a compromised web page. Once clicked, Central Dogma issues a redirect to the attacker's site, which typically mirrors a legitimate login prompt to harvest credentials. Refer to the GitHub Security Advisory GHSA-4hr2-xf7w-jf76 for advisory-level technical detail.

Detection Methods for CVE-2025-11222

Indicators of Compromise

HTTP requests to Central Dogma endpoints containing redirect parameters pointing to external, non-corporate domains
Referer headers on external phishing pages that originate from the Central Dogma hostname
Outbound user navigation events from Central Dogma URLs to newly registered or low-reputation domains

Detection Strategies

Inspect Central Dogma access logs for query parameters carrying absolute URLs with schemes such as http:// or https:// targeting unfamiliar hosts
Correlate web proxy telemetry to identify chains where users transit from Central Dogma directly to external domains that subsequently request credentials
Alert on 3xx HTTP responses from Central Dogma whose Location headers reference domains outside the organization's allowlist

Monitoring Recommendations

Ingest Central Dogma HTTP logs into a centralized log platform and build detections for redirect parameter abuse
Monitor email and messaging gateways for links pointing to Central Dogma hosts that include suspicious query strings
Track user reports of unexpected login prompts appearing after clicking internal service links

How to Mitigate CVE-2025-11222

Immediate Actions Required

Upgrade Central Dogma to version 0.78.0 or later across all environments hosting the service
Inventory internal links, bookmarks, and documentation that reference Central Dogma endpoints for evidence of parameter tampering
Notify users of the phishing risk and reinforce verification of destination URLs after clicking links

Patch Information

LINE Corporation released the fix in Central Dogma version 0.78.0. Review the GitHub Security Advisory GHSA-4hr2-xf7w-jf76 for release notes and upgrade guidance. Apply the update to all Central Dogma replicas and restart the service to enforce the new redirect validation logic.

Workarounds

Place Central Dogma behind a reverse proxy that strips or validates redirect parameters against a strict allowlist
Enforce web application firewall rules that block query strings containing absolute external URLs in redirect parameters
Restrict Central Dogma access to authenticated internal users via network segmentation and identity-aware proxies

bash

# Example WAF rule to block external redirect parameters (ModSecurity syntax)
SecRule ARGS:redirect "@rx ^https?://(?!(centraldogma\.internal\.example|localhost))" \
    "id:1011222,phase:2,deny,status:400,msg:'CVE-2025-11222 Open Redirect attempt blocked'"