CVE-2025-62361: WeGIA Open Redirect Vulnerability

CVE-2025-62361 Overview

CVE-2025-62361 is an Open Redirect vulnerability [CWE-601] in WeGIA, an open source Web Manager for Institutions targeted at Portuguese-language users. The flaw affects the control.php endpoint, specifically the nextPage parameter when invoking metodo=listarTodos with nomeClasse=AlmoxarifeControle. Attackers can craft URLs that redirect authenticated users to arbitrary external domains. This enables phishing campaigns, malicious payload distribution, and credential theft against WeGIA users. The issue is fixed in version 3.5.0.

Critical Impact

Attackers can redirect authenticated WeGIA users to attacker-controlled domains through a trusted application URL, facilitating credential theft and drive-by malware delivery.

Affected Products

• WeGIA versions prior to 3.5.0
• Component: controle/AlmoxarifeControle.php (listarTodos method)
• Endpoint: html/almoxarifado/control.php

Discovery Timeline

• 2025-10-13 - CVE-2025-62361 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62361

Vulnerability Analysis

The vulnerability resides in the listarTodos method of the AlmoxarifeControle class. The method reads the nextPage parameter directly from $_REQUEST and uses it for redirection after processing. While the code applies FILTER_VALIDATE_URL, that filter only confirms the value is a syntactically valid URL. It does not restrict the target host to the application's own domain. An attacker can supply any well-formed external URL and pass validation.

Because the vulnerable endpoint sits within an authenticated workflow, the redirect originates from a domain the victim trusts. This makes phishing pages hosted on attacker infrastructure appear to be part of a legitimate WeGIA session, increasing the probability of credential capture or malicious download acceptance.

Root Cause

The root cause is insufficient validation of user-supplied redirection targets. Syntactic URL validation does not enforce an allowlist of permitted hosts, protocols, or path prefixes. The application trusts the nextPage value from the HTTP request without confirming it points back into the WeGIA application.

Attack Vector

Exploitation requires an attacker to distribute a crafted link and requires user interaction. A low-privileged authenticated user who clicks the link is redirected from the trusted WeGIA host to an external domain chosen by the attacker.

// Vulnerable pattern (pre-3.5.0) in controle/AlmoxarifeControle.php
public function listarTodos(){
    $nextPage = trim($_REQUEST['nextPage']);

    if(!filter_var($nextPage, FILTER_VALIDATE_URL)){
        http_response_code(400);
        exit('Erro, a URL informada para a proxima pagina nao e valida.');
    }
    // ... redirect using $nextPage without host allowlist
}

// Example malicious request
// GET /html/almoxarifado/control.php?metodo=listarTodos
//     &nomeClasse=AlmoxarifeControle
//     &nextPage=https://attacker.example/phish

Source: WeGIA Security Advisory GHSA-m99c-77f2-gpjx

Detection Methods for CVE-2025-62361

Indicators of Compromise

• HTTP requests to control.php containing metodo=listarTodos and nomeClasse=AlmoxarifeControle with a nextPage parameter whose host is not the WeGIA application domain.
• Web server access logs showing external absolute URLs supplied in the nextPage query parameter.
• Referrer headers on external phishing infrastructure that originate from the WeGIA application host.

Detection Strategies

• Parse web server and reverse-proxy logs for nextPage= values and flag any where the parsed hostname differs from the application's canonical hostname.
• Deploy a Web Application Firewall (WAF) rule that inspects nextPage and blocks values matching ^https?:// targeting non-allowlisted hosts.
• Alert on outbound HTTP 3xx responses issued by control.php with a Location header pointing to an external domain.

Monitoring Recommendations

• Monitor authentication and session logs for user reports of unexpected redirects following WeGIA navigation.
• Track email and messaging platforms for URLs referencing AlmoxarifeControle and nextPage parameters distributed to WeGIA users.
• Correlate WeGIA access logs with DNS or proxy telemetry to identify redirects to newly registered or low-reputation domains.

How to Mitigate CVE-2025-62361

Immediate Actions Required

• Upgrade WeGIA to version 3.5.0 or later, which contains the official fix committed in 2b53003.
• Audit web server logs for prior use of the nextPage parameter with non-local hostnames and notify affected users.
• Communicate to WeGIA users that they should verify the destination domain before submitting credentials after clicking application links.

Patch Information

The fix is included in WeGIA 3.5.0. The commit refactors AlmoxarifeControle and AlmoxarifeDAO, introduces CSRF and utility helpers (classes/Csrf.php, classes/Util.php), and removes the direct use of the unvalidated nextPage value in the listarTodos flow. See the GitHub Security Advisory GHSA-m99c-77f2-gpjx for full details.

Workarounds

• If patching is not immediately possible, block or filter requests to html/almoxarifado/control.php that contain a nextPage parameter with an absolute external URL at the WAF or reverse proxy layer.
• Restrict access to the AlmoxarifeControle endpoints to trusted internal networks or VPN-connected users until the upgrade is applied.

# Example NGINX rule to block external absolute URLs in nextPage
location /html/almoxarifado/control.php {
    if ($arg_nextPage ~* "^https?://(?!wegia\.example\.org/)") {
        return 403;
    }
    proxy_pass http://wegia_backend;
}