Ctfd
Monthly
Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling phishing of competition participants. The vulnerability lies in the _is_safe_url() function within CTFd/utils/validators/__init__.py, which fails to correctly reject malformed or protocol-relative values supplied via the 'Next' query parameter. The vendor CHANGELOG for the patched release (3.8.4) further notes that attacker-controlled links could serve as a vector for arbitrary JavaScript execution if clicked, suggesting the integrity impact may exceed the open-redirect framing; a public exploit writeup exists and no active KEV listing is present at time of analysis.
In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify` endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling phishing of competition participants. The vulnerability lies in the _is_safe_url() function within CTFd/utils/validators/__init__.py, which fails to correctly reject malformed or protocol-relative values supplied via the 'Next' query parameter. The vendor CHANGELOG for the patched release (3.8.4) further notes that attacker-controlled links could serve as a vector for arbitrary JavaScript execution if clicked, suggesting the integrity impact may exceed the open-redirect framing; a public exploit writeup exists and no active KEV listing is present at time of analysis.
In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify` endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.