CVE-2026-28413: Plone isURLInPortal CSRF Vulnerability

CVE-2026-28413 Overview

CVE-2026-28413 is an Open Redirect vulnerability affecting Products.isurlinportal, a replacement for the isURLInPortal method in Plone CMS. The vulnerability allows attackers to craft malicious URLs that bypass URL validation checks, potentially redirecting users to external malicious websites after authentication. This type of vulnerability (CWE-601) is commonly exploited in phishing attacks and credential theft campaigns.

Critical Impact
Attackers can exploit this vulnerability to redirect authenticated Plone users to malicious external websites, enabling credential harvesting, malware distribution, or social engineering attacks.

Affected Products

Products.isurlinportal versions prior to 2.1.0
Products.isurlinportal versions prior to 3.1.0
Products.isurlinportal versions prior to 4.0.0

Discovery Timeline

2026-03-05 - CVE-2026-28413 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28413

Vulnerability Analysis

This Open Redirect vulnerability exists in the URL validation logic of Products.isurlinportal. The component is designed to validate that redirect URLs point to locations within the Plone portal, preventing users from being redirected to external sites. However, a flaw in the validation logic fails to properly handle URLs with multiple leading forward slashes.

When a URL like /login?came_from=////evil.example is processed, the validation incorrectly interprets it as an internal path rather than recognizing the protocol-relative URL pattern. This allows the redirect to proceed to an external domain after the user successfully authenticates.

Root Cause

The root cause lies in improper input validation of the came_from parameter in redirect URLs. The isURLInPortal replacement function does not adequately sanitize or validate URLs containing multiple consecutive forward slashes. URLs beginning with //// are parsed by browsers as protocol-relative URLs (equivalent to //evil.example), which browsers resolve using the current page's protocol to navigate to external domains.

Attack Vector

The attack is network-based and requires no authentication or user privileges to initiate. An attacker crafts a malicious URL targeting the Plone login page with a specially formatted came_from parameter. The attacker then distributes this link through phishing emails, compromised websites, or other social engineering vectors.

When a victim clicks the malicious link and successfully logs into the Plone portal, they are automatically redirected to the attacker-controlled external website. This can be used to harvest credentials through a fake login page, distribute malware, or conduct further social engineering attacks while the victim believes they are still interacting with a trusted site.

The exploitation flow follows this pattern:

Attacker constructs URL: /login?came_from=////evil.example
Victim clicks the malicious link and sees the legitimate Plone login page
Victim authenticates successfully
Plone validates the came_from parameter using the flawed logic
User is redirected to //evil.example (resolved as https://evil.example or http://evil.example)

For technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-28413

Indicators of Compromise

HTTP requests to login endpoints containing came_from parameters with multiple consecutive forward slashes (////)
Login redirect patterns that result in navigation to external domains
Unusual patterns of authentication followed by immediate off-site redirects
User reports of unexpected redirects after Plone authentication

Detection Strategies

Implement web application firewall (WAF) rules to detect and block URLs with multiple consecutive slashes in redirect parameters
Monitor HTTP access logs for requests containing patterns like came_from=//// or similar URL manipulation attempts
Deploy SentinelOne Singularity to detect and alert on suspicious redirect patterns and potential phishing activity
Analyze authentication logs for sessions that terminate immediately after login with external redirect targets

Monitoring Recommendations

Enable detailed logging for all authentication events and redirect operations in Plone
Configure alerts for any came_from parameter values that do not match expected internal URL patterns
Implement real-time monitoring of HTTP request parameters targeting authentication endpoints
Review web server access logs regularly for reconnaissance or exploitation attempts

How to Mitigate CVE-2026-28413

Immediate Actions Required

Upgrade Products.isurlinportal to version 2.1.0, 3.1.0, or 4.0.0 depending on your current major version
Review authentication logs for signs of prior exploitation attempts
Notify users about potential phishing attempts using open redirect vulnerabilities
Consider implementing additional URL validation at the web application firewall level

Patch Information

Security patches have been released by the Plone project to address this vulnerability. The fixed versions are 2.1.0, 3.1.0, and 4.0.0 for their respective version branches. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

Configure web application firewall rules to block or sanitize URLs containing multiple consecutive forward slashes in query parameters
Implement strict URL whitelisting for the came_from parameter to only allow known internal paths
Deploy reverse proxy rules to normalize URLs and remove duplicate forward slashes before they reach the application
Consider temporarily disabling the redirect functionality if it is not critical to operations until patching can be completed

bash

# Example nginx configuration to normalize multiple slashes
merge_slashes on;

# Block requests with suspicious came_from parameters
if ($query_string ~* "came_from=/{3,}") {
    return 403;
}