CVE-2025-47789: Horilla HRMS SSRF Vulnerability

CVE-2025-47789 Overview

CVE-2025-47789 is an open redirect vulnerability [CWE-601] in Horilla, a free and open source Human Resource Management System (HRMS). Versions up to and including 1.3 fail to validate the next parameter used during the login flow. An attacker can craft a Horilla URL that references an external domain. After a victim clicks the link and authenticates, the application redirects them to the attacker-controlled site. This enables phishing campaigns that impersonate Horilla and trick users into surrendering credentials or other sensitive data. The maintainers addressed the issue in commit 1c72404df6888bb23af73c767fdaee5e6679ebd6.

Critical Impact
Attackers can weaponize trusted Horilla login URLs to redirect authenticated users to phishing or malware-hosting domains, undermining user trust and enabling credential theft.

Affected Products

Horilla HRMS versions up to and including 1.3
Horilla open source distribution (horilla:horilla)
All deployments running vulnerable base/views.py login handler

Discovery Timeline

2025-05-15 - CVE-2025-47789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47789

Vulnerability Analysis

The vulnerability resides in Horilla's Django-based login flow. The application accepts a redirect target through a next-style query parameter and passes the value directly to a redirect response after successful authentication. Because the target is not validated against an allowlist of internal hosts, attackers can supply any absolute URL.

The attack requires user interaction. An attacker distributes a crafted Horilla login link that includes an external redirect target. The victim, seeing a legitimate Horilla domain, authenticates and is then transported to the attacker's site. This site can mimic Horilla to harvest credentials, deliver malware, or execute follow-on social engineering.

Open redirects also erode phishing defenses. Email gateways and URL reputation systems trust the Horilla domain, so malicious links bypass filters that would otherwise block a direct link to the attacker infrastructure.

Root Cause

The login view in base/views.py did not verify that the post-login redirect destination pointed to an allowed host. Django provides url_has_allowed_host_and_scheme for exactly this purpose, but the function was not applied to the user-controlled parameter before issuing the redirect.

Attack Vector

Exploitation is remote and requires only that the victim click a crafted link and complete login. No prior privileges are required on the attacker's side.

python

 from django.urls import reverse, reverse_lazy
 from django.utils import timezone
 from django.utils.html import strip_tags
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.translation import gettext as _
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_http_methods

Source: Horilla security patch commit 1c72404. The patch imports Django's url_has_allowed_host_and_scheme helper and applies it to validate the next parameter before performing the redirect.

Detection Methods for CVE-2025-47789

Indicators of Compromise

Login requests containing a next (or equivalent) parameter with an absolute URL pointing to a domain outside the organization's Horilla deployment.
HTTP 302 responses from the Horilla login endpoint whose Location header targets an external host.
Referer logs showing users arriving at unfamiliar third-party domains immediately after visiting the Horilla login page.

Detection Strategies

Inspect web server access logs for requests to the login route containing URL-encoded external hostnames in the redirect parameter.
Alert on outbound redirects from Horilla whose destination scheme or host does not match the approved application origin.
Correlate phishing report submissions with recent Horilla logins to identify users who may have been redirected to malicious sites.

Monitoring Recommendations

Enable verbose logging on the Horilla authentication endpoints and forward logs to a centralized SIEM for retention and query.
Monitor DNS and proxy telemetry for spikes in traffic to newly registered domains that follow Horilla login sessions.
Track user-reported phishing incidents that reference Horilla-branded URLs and pivot on the referring redirect chain.

How to Mitigate CVE-2025-47789

Immediate Actions Required

Upgrade Horilla to a release that includes commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 or later.
Audit user-facing communications and warn staff about phishing links that abuse the legitimate Horilla domain.
Rotate credentials for any users who report being redirected to unexpected sites after logging in.

Patch Information

The fix is delivered in commit 1c72404df6888bb23af73c767fdaee5e6679ebd6. Details are documented in GitHub Security Advisory GHSA-cqp5-xx4j-r468. Administrators running Horilla 1.3 or earlier should update to a patched build.

Workarounds

Deploy a reverse proxy or web application firewall rule that strips or rejects absolute URLs in the login next parameter.
Restrict the login endpoint to accept only relative paths in the redirect argument until the upgrade is deployed.
Educate users to verify the browser address bar after login and to report unexpected external redirects.

bash

# Example NGINX rule to block external redirect targets on the Horilla login endpoint
location /login/ {
    if ($arg_next ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://horilla_upstream;
}