CVE-2025-58044: Fit2cloud JumpServer Open Redirect Issue

CVE-2025-58044 Overview

JumpServer is an open source bastion host and operations security audit system used to manage privileged access. CVE-2025-58044 is an Open Redirect vulnerability [CWE-601] in the /core/i18n/ endpoint. The endpoint accepts the HTTP Referer header as the redirection target without proper validation. An attacker can craft a link that routes authenticated users to an attacker-controlled domain after visiting the endpoint. This behavior enables phishing and credential harvesting workflows that leverage the trust of the legitimate JumpServer host. The issue affects releases prior to v3.10.19 and v4.10.5.

Critical Impact
Attackers can abuse the trusted JumpServer domain to redirect users to malicious sites, facilitating phishing against privileged administrators who rely on the bastion host.

Affected Products

Fit2Cloud JumpServer versions prior to v3.10.19 (3.x branch)
Fit2Cloud JumpServer versions prior to v4.10.5 (4.x branch)
Deployments exposing the /core/i18n/ endpoint to untrusted networks

Discovery Timeline

2025-12-01 - CVE-2025-58044 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58044

Vulnerability Analysis

The vulnerability resides in the internationalization handler at /core/i18n/<lang>/. The handler switches the user's language preference and then redirects the browser to the page the user came from. To determine that destination, the code reads the HTTP Referer header and passes it directly to a redirect response. No allowlist, host comparison, or URL parsing is performed on the header value before use.

An attacker sets the Referer header to an external URL through a crafted link or intermediate page. When a JumpServer user follows the link, the server issues an HTTP 302 pointing at the attacker domain. Because the redirect originates from the trusted bastion host, users and email filters often treat the initial URL as safe.

JumpServer administers privileged sessions to production infrastructure, making its user base a high-value phishing target. Redirect chains launched from a bastion domain increase the credibility of cloned login pages designed to capture SSO or MFA responses.

Root Cause

The root cause is missing validation of the Referer header before use as a redirect target. The fix introduces a dedicated SafeRedirectMiddleware and imports urlparse and quote from urllib.parse for safe URL handling.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond clicking a crafted link. The attacker controls the Referer header via an intermediate page or a <meta> refresh redirect pointing to /core/i18n/.

python

# Patch: apps/jumpserver/middleware.py
 import os
 import re
 import time
+from urllib.parse import urlparse, quote
 
 import pytz
 from django.conf import settings
 from django.core.exceptions import MiddlewareNotUsed
 from django.http.response import HttpResponseForbidden
 from django.shortcuts import HttpResponse
-from django.utils import timezone, translation
+from django.shortcuts import redirect
+from django.urls import reverse
+from django.utils import timezone

# Patch: apps/jumpserver/settings/base.py — register safe redirect middleware
     'authentication.middleware.ThirdPartyLoginMiddleware',
     'authentication.middleware.SessionCookieMiddleware',
     'simple_history.middleware.HistoryRequestMiddleware',
+    'jumpserver.middleware.SafeRedirectMiddleware',
     'jumpserver.middleware.EndMiddleware',
 ]
# Source: https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b

Detection Methods for CVE-2025-58044

Indicators of Compromise

HTTP requests to /core/i18n/ with a Referer header pointing to an external, non-JumpServer domain.
HTTP 302 responses from JumpServer with a Location header referencing untrusted hosts.
Inbound clicks to JumpServer URLs originating from email or messaging platforms outside normal admin workflows.

Detection Strategies

Parse JumpServer and reverse proxy access logs for requests matching the pattern GET /core/i18n/ combined with cross-origin Referer values.
Correlate 302 responses from JumpServer with subsequent DNS lookups for newly registered or low-reputation domains.
Alert on JumpServer requests where the Referer host does not match the configured SITE_URL or session cookie domain.

Monitoring Recommendations

Enable web server access logging with full Referer and Location header capture in front of JumpServer.
Monitor authentication events for JumpServer users who follow external redirects and then re-authenticate, which suggests credential replay attempts.
Track version banners across JumpServer instances and alert when any node reports a version below v3.10.19 or v4.10.5.

How to Mitigate CVE-2025-58044

Immediate Actions Required

Upgrade JumpServer to v3.10.19 on the 3.x branch or v4.10.5 on the 4.x branch.
Restrict access to the JumpServer web interface to trusted administrative networks or VPN ranges.
Notify JumpServer administrators about phishing risk and reinforce verification of destination URLs after language changes.

Patch Information

The fix is delivered in commit 36ae076c and documented in the JumpServer GitHub Security Advisory GHSA-h762-mj7p-jwjq. The patch adds a SafeRedirectMiddleware to the Django middleware chain and validates redirect targets using urlparse before returning a response.

Workarounds

Deploy a reverse proxy rule that strips or normalizes the Referer header on requests to /core/i18n/.
Block outbound HTTP 302 responses from JumpServer whose Location header does not match the internal site domain.
Disable the language switch endpoint at the proxy layer until the upgrade window is available.

bash

# NGINX example: reject /core/i18n/ requests carrying an external Referer
location /core/i18n/ {
    if ($http_referer !~* "^https?://jumpserver\.example\.com/") {
        return 400;
    }
    proxy_pass http://jumpserver_upstream;
}