CVE-2025-6089: Astun iShare Maps Open Redirect Flaw

CVE-2025-6089 Overview

CVE-2025-6089 is an open redirect vulnerability [CWE-601] in Astun Technology iShare Maps 5.4.0. The flaw resides in the atCheckJS.aspx file, where the ref parameter is not properly validated before being used in a redirect. Attackers can craft URLs that redirect victims to attacker-controlled destinations after they interact with the link. The issue is remotely exploitable across the network and requires user interaction. The exploit has been publicly disclosed. The vendor was contacted before disclosure but did not respond.

Critical Impact
Attackers can leverage the trusted iShare Maps domain to redirect users to malicious sites, enabling phishing and credential theft campaigns against organizations using the affected version.

Affected Products

Astun Technology iShare Maps 5.4.0
Deployments exposing atCheckJS.aspx to untrusted networks
Public-facing mapping portals built on iShare Maps 5.4.0

Discovery Timeline

2025-06-15 - CVE-2025-6089 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6089

Vulnerability Analysis

The vulnerability is a URL redirection to untrusted site issue [CWE-601], commonly referred to as open redirect. The affected endpoint atCheckJS.aspx accepts a ref parameter that controls the destination of a subsequent redirect. Because the parameter value is not validated against an allowlist of trusted hosts, an attacker can supply an arbitrary external URL. When a victim clicks a crafted link, the application redirects the browser to the attacker-supplied location.

Open redirects primarily support social engineering. The initial URL points to the legitimate iShare Maps host, which increases the likelihood that users, mail gateways, and URL reputation systems will trust the link. After redirection, the victim lands on an attacker-controlled page that can host phishing forms, malware downloads, or drive-by exploit content.

Root Cause

The root cause is missing validation of the ref query parameter in atCheckJS.aspx. The handler treats the parameter as a trusted URL and passes it directly to a redirect function without confirming that the target is an internal path or an approved external host.

Attack Vector

Exploitation requires the attacker to construct a URL of the form https://<victim-host>/atCheckJS.aspx?ref=<attacker-url> and deliver it to a target through email, chat, or a malicious web page. When the user activates the link, the vulnerable endpoint issues an HTTP redirect to the attacker-controlled destination. No authentication is required, and no server-side compromise of the iShare Maps host occurs. Details are documented in the VulDB entry #312556.

No verified proof-of-concept code is available in the referenced sources. The vulnerability mechanism is described in prose based on the advisory content.

Detection Methods for CVE-2025-6089

Indicators of Compromise

Web server access logs containing requests to atCheckJS.aspx with a ref parameter pointing to an external domain.
HTTP 302 or 301 responses from atCheckJS.aspx whose Location header references a host outside the organization.
Inbound email or chat messages containing links to the iShare Maps host with suspicious ref values.
User reports of unexpected redirects from the mapping portal to unfamiliar sites.

Detection Strategies

Deploy a web application firewall rule that inspects ref parameter values on atCheckJS.aspx and blocks values that are absolute URLs to untrusted hosts.
Search proxy and DNS logs for outbound traffic that originated from a redirect off the iShare Maps host.
Correlate phishing report data with URL patterns matching atCheckJS.aspx?ref=.

Monitoring Recommendations

Alert on any request to atCheckJS.aspx where the ref parameter contains http://, https://, or // prefixes pointing off-domain.
Track the top external hosts referenced in ref parameters and flag anomalous new destinations.
Include the iShare Maps host in phishing simulation URL monitoring to catch abuse patterns.

How to Mitigate CVE-2025-6089

Immediate Actions Required

Restrict access to atCheckJS.aspx at the reverse proxy or WAF until a vendor fix is validated.
Enforce an allowlist of permitted redirect targets and reject requests with external URLs in the ref parameter.
Notify users through security awareness channels that links to the iShare Maps portal should be inspected for embedded ref values.

Patch Information

No vendor patch or advisory is listed in the referenced sources. Astun Technology did not respond to the pre-disclosure contact documented in the VulDB submission #587876. Operators should contact Astun Technology directly for remediation guidance and monitor vendor channels for a security release.

Workarounds

Add a WAF signature that drops requests to atCheckJS.aspx when the ref parameter contains an absolute URL or protocol-relative prefix.
Rewrite responses at the reverse proxy so that Location headers pointing outside approved domains are stripped or replaced with an interstitial warning page.
If atCheckJS.aspx is not required for business operations, block the endpoint entirely at the perimeter.
Apply Content Security Policy and referrer policies to reduce the value of redirected traffic for phishing chains.

bash

# Example WAF rule (ModSecurity) to block off-domain redirects via ref parameter
SecRule REQUEST_FILENAME "@endsWith /atCheckJS.aspx" \
    "chain,phase:2,deny,status:403,id:1006089,\
    msg:'CVE-2025-6089 open redirect attempt on atCheckJS.aspx'"
    SecRule ARGS:ref "@rx ^(https?:)?//" "t:none,t:lowercase"