EUVD-2025-210728
GHSA-xcvf-46f4-xwxf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because Host header manipulation is blocked by browsers and email clients, requiring a non-standard attack path; S:C because the redirect crosses to a different origin domain; UI:R because a user must follow the redirect for any phishing impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
AnalysisAI
Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware, enabling attackers to redirect users to arbitrary external domains for phishing and credential theft. Applications using the RedirectSlashes middleware that expose their chi router to environments where the Host header can be forged are directly at risk. No public exploit is identified in CISA KEV; however, a functional proof-of-concept is documented in the GHSA advisory, and the GHSA itself characterizes real-world exploitability as lower-severity because standard browsers and email clients cannot be used to manipulate the Host header.
Technical ContextAI
chi (CPE: cpe:2.3:a:go-chi:chi:*:*:*:*:*:*:*:*) is a widely used Go HTTP routing library. The vulnerability originates in middleware/strip.go at the RedirectSlashes function, which constructs the redirect target URL by directly incorporating the HTTP Host header without sanitization or validation. Because the Host header is user-controlled, an attacker sending a request with a forged Host value causes the server to issue a 3xx redirect pointing to the attacker-specified domain. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) precisely characterizes this root cause: untrusted user input flows directly into a redirect response. The affected code path is only active when an application explicitly registers the RedirectSlashes middleware in the chi router chain.
RemediationAI
Upgrade to chi v5.2.2 or later, which resolves the Host header injection at the patch commit https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65. Vendor-released patch: 5.2.2. If an immediate upgrade is not feasible, removing the RedirectSlashes middleware from the router configuration eliminates the vulnerable code path entirely, with the trade-off that trailing-slash normalization for URL paths must be handled elsewhere or accepted as absent behavior. As a defense-in-depth measure, configuring a reverse proxy or load balancer to validate and normalize the HTTP Host header before forwarding requests to the chi application prevents forged Host values from reaching the middleware; this adds infrastructure complexity and may require proxy-specific configuration. See the full advisory at https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today