CVE-2025-4838: Funiture Login Open Redirect Vulnerability

CVE-2025-4838 Overview

CVE-2025-4838 is an open redirect vulnerability [CWE-601] in the kanwangzjm Funiture application. The flaw resides in the doPost function of /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java within the Login component. Attackers can manipulate the ret parameter to redirect authenticated or targeted users to arbitrary external URLs. The exploit has been publicly disclosed and can be launched remotely without authentication, though it requires user interaction. Because Funiture uses continuous delivery with rolling releases, no discrete affected or fixed version identifiers are published.

Critical Impact
Attackers can craft URLs pointing to the Funiture login endpoint that redirect victims to attacker-controlled sites, enabling phishing and credential theft campaigns that leverage the trust of the legitimate application domain.

Affected Products

kanwangzjm Funiture up to commit 71ca0fb0658b3d839d9e049ac36429207f05329b
Affected file: /funiture-master/src/main/java/com/app/mvc/acl/servlet/LoginServlet.java
Affected component: Login (doPost handler)

Discovery Timeline

2025-05-17 - CVE-2025-4838 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4838

Vulnerability Analysis

The vulnerability is an open redirect classified under [CWE-601] URL Redirection to Untrusted Site. The doPost method in LoginServlet.java accepts a ret request parameter used to determine the post-authentication redirect destination. The servlet passes this value directly to a redirect mechanism without validating that the target belongs to an allowlisted origin or a relative path within the application. An attacker can supply an absolute URL pointing to an external domain, and the server responds by redirecting the victim's browser to that destination.

While open redirect issues do not directly compromise confidentiality or integrity of the application data, they are a common building block in phishing chains and OAuth flow abuse. The CVSS 4.0 vector reflects a network-reachable, low-complexity attack requiring user interaction with limited integrity impact on the victim.

Root Cause

The root cause is missing validation of user-supplied redirect targets. The ret parameter flows from an untrusted HTTP request into a redirect API without checks against a domain allowlist, without stripping absolute scheme and host components, and without enforcing same-origin constraints. Any value the caller provides is honored by the response.

Attack Vector

An attacker crafts a URL such as https://<funiture-host>/login?ret=https://attacker.example/. The attacker distributes the link through email, chat, or a compromised page. When the victim clicks and completes the login flow, the servlet issues an HTTP redirect to the attacker-controlled destination. The victim's browser follows the redirect from what appears to be the trusted Funiture domain, increasing the likelihood that the victim enters credentials or downloads content from the destination.

See the GitHub PoC Repository for the disclosed proof of concept.

Detection Methods for CVE-2025-4838

Indicators of Compromise

HTTP requests to the Funiture login endpoint containing a ret parameter with an absolute URL that references an external host.
HTTP 302 or 303 responses from the Funiture application with a Location header pointing to a domain outside the organization.
Referrer logs on downstream phishing infrastructure showing the Funiture host as the immediate referrer.

Detection Strategies

Inspect web server and reverse proxy access logs for ret query parameter values that start with http://, https://, //, or encoded variants such as %2F%2F.
Correlate outbound redirect responses from the login endpoint with the destination host in the Location response header to flag redirects to non-corporate domains.
Deploy a web application firewall rule that blocks or alerts on ret parameters whose decoded value does not match an allowlisted internal path.

Monitoring Recommendations

Alert on spikes in LoginServlet requests carrying the ret parameter, particularly with encoded URL characters.
Monitor user reports of phishing pages that display Funiture-branded login prompts on unfamiliar domains.
Track referrer statistics from the Funiture domain to unknown external destinations across proxy and DNS telemetry.

How to Mitigate CVE-2025-4838

Immediate Actions Required

Restrict the ret parameter in LoginServlet.doPost to relative paths only, rejecting values that contain a scheme, //, or a host component.
Implement an allowlist of permitted redirect targets and reject any request whose decoded ret value falls outside the list.
Deploy a WAF rule to block requests to the login endpoint containing absolute URLs in the ret parameter until a code fix is deployed.

Patch Information

The vendor uses continuous delivery with rolling releases, and no specific patched version is published. Operators running kanwangzjm Funiture should pull the latest commit from the upstream repository and verify that redirect handling in LoginServlet.java validates the ret parameter against an allowlist or restricts it to relative URLs. Track fix status through the VulDB #309306 entry.

Workarounds

Remove or ignore the ret parameter server-side and redirect all successful logins to a fixed internal landing page.
Add a warning interstitial page for any redirect leaving the application origin, requiring explicit user confirmation.
Configure the reverse proxy to strip external URLs from the ret parameter before requests reach the application.

bash

# Example nginx rule to block external redirects on the login endpoint
location /funiture-master/login {
    if ($arg_ret ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://funiture_backend;
}