CVE-2026-28413: Plone isURLInPortal CSRF Vulnerability

CVE-2026-28413 Overview

CVE-2026-28413 is an Open Redirect vulnerability affecting Products.isurlinportal, a replacement for the isURLInPortal method in Plone CMS. The vulnerability allows attackers to craft malicious URLs that bypass URL validation checks, potentially redirecting users to external malicious websites after authentication. This type of vulnerability (CWE-601) is commonly exploited in phishing attacks and credential theft campaigns.

Critical Impact

Attackers can exploit this vulnerability to redirect authenticated Plone users to malicious external websites, enabling credential harvesting, malware distribution, or social engineering attacks.

Affected Products

• Products.isurlinportal versions prior to 2.1.0
• Products.isurlinportal versions prior to 3.1.0
• Products.isurlinportal versions prior to 4.0.0

Discovery Timeline

• 2026-03-05 - CVE-2026-28413 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28413

Vulnerability Analysis

This Open Redirect vulnerability exists in the URL validation logic of Products.isurlinportal. The component is designed to validate that redirect URLs point to locations within the Plone portal, preventing users from being redirected to external sites. However, a flaw in the validation logic fails to properly handle URLs with multiple leading forward slashes.

When a URL like /login?came_from=////evil.example is processed, the validation incorrectly interprets it as an internal path rather than recognizing the protocol-relative URL pattern. This allows the redirect to proceed to an external domain after the user successfully authenticates.

Root Cause

The root cause lies in improper input validation of the came_from parameter in redirect URLs. The isURLInPortal replacement function does not adequately sanitize or validate URLs containing multiple consecutive forward slashes. URLs beginning with //// are parsed by browsers as protocol-relative URLs (equivalent to //evil.example), which browsers resolve using the current page's protocol to navigate to external domains.

Attack Vector

The attack is network-based and requires no authentication or user privileges to initiate. An attacker crafts a malicious URL targeting the Plone login page with a specially formatted came_from parameter. The attacker then distributes this link through phishing emails, compromised websites, or other social engineering vectors.

When a victim clicks the malicious link and successfully logs into the Plone portal, they are automatically redirected to the attacker-controlled external website. This can be used to harvest credentials through a fake login page, distribute malware, or conduct further social engineering attacks while the victim believes they are still interacting with a trusted site.

The exploitation flow follows this pattern:

1. Attacker constructs URL: /login?came_from=////evil.example
2. Victim clicks the malicious link and sees the legitimate Plone login page
3. Victim authenticates successfully
4. Plone validates the came_from parameter using the flawed logic
5. User is redirected to //evil.example (resolved as https://evil.example or http://evil.example)

For technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-28413

Indicators of Compromise

• HTTP requests to login endpoints containing came_from parameters with multiple consecutive forward slashes (////)
• Login redirect patterns that result in navigation to external domains
• Unusual patterns of authentication followed by immediate off-site redirects
• User reports of unexpected redirects after Plone authentication

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block URLs with multiple consecutive slashes in redirect parameters
• Monitor HTTP access logs for requests containing patterns like came_from=//// or similar URL manipulation attempts
• Deploy SentinelOne Singularity to detect and alert on suspicious redirect patterns and potential phishing activity
• Analyze authentication logs for sessions that terminate immediately after login with external redirect targets

Monitoring Recommendations

• Enable detailed logging for all authentication events and redirect operations in Plone
• Configure alerts for any came_from parameter values that do not match expected internal URL patterns
• Implement real-time monitoring of HTTP request parameters targeting authentication endpoints
• Review web server access logs regularly for reconnaissance or exploitation attempts

How to Mitigate CVE-2026-28413

Immediate Actions Required

• Upgrade Products.isurlinportal to version 2.1.0, 3.1.0, or 4.0.0 depending on your current major version
• Review authentication logs for signs of prior exploitation attempts
• Notify users about potential phishing attempts using open redirect vulnerabilities
• Consider implementing additional URL validation at the web application firewall level

Patch Information

Security patches have been released by the Plone project to address this vulnerability. The fixed versions are 2.1.0, 3.1.0, and 4.0.0 for their respective version branches. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Configure web application firewall rules to block or sanitize URLs containing multiple consecutive forward slashes in query parameters
• Implement strict URL whitelisting for the came_from parameter to only allow known internal paths
• Deploy reverse proxy rules to normalize URLs and remove duplicate forward slashes before they reach the application
• Consider temporarily disabling the redirect functionality if it is not critical to operations until patching can be completed

# Example nginx configuration to normalize multiple slashes
merge_slashes on;

# Block requests with suspicious came_from parameters
if ($query_string ~* "came_from=/{3,}") {
    return 403;
}