Phoenix Live View
Monthly
Open redirect in Phoenix LiveView's redirect/2 allows an unauthenticated remote attacker to send a victim's browser to an arbitrary external origin by embedding ASCII tab (\t), line feed (\n), or carriage return (\r) in the :to path argument. The private validate_local_url!/2 guard in lib/phoenix_live_view.ex rejects leading double-slashes and backslashes but does not strip or reject these whitespace control characters; browsers silently discard them before URL resolution, so a payload such as /<TAB>/example.com validates as a local path yet resolves to the scheme-relative URL //example.com. Affected versions span three release trains: 0.5.0–1.0.18, 1.1.0-rc.0–1.1.32, and 1.2.0-rc.0–1.2.8. No public exploit code or CISA KEV listing has been identified at time of analysis.
URL scheme validation bypass in Phoenix LiveView 1.2.2–1.2.6 allows unauthenticated attackers to inject javascript: URLs that execute in a victim's browser session when clicked. The root cause is a first-byte ASCII letter guard in the internal uri_scheme/1 helper: inputs prefixed with whitespace or C0 control characters bypass scheme detection entirely and are treated as safe relative paths, while WHATWG-compliant browsers silently strip those leading bytes before parsing — converting what LiveView sees as a harmless string into an executable javascript: URL. Applications rendering user-supplied URLs (profile links, redirect targets, external references) via the <.link href={...}> component are directly affected; no public exploit code has been identified at time of analysis, and a patched release (1.2.7) is available.
Open redirect in Phoenix LiveView's redirect/2 allows an unauthenticated remote attacker to send a victim's browser to an arbitrary external origin by embedding ASCII tab (\t), line feed (\n), or carriage return (\r) in the :to path argument. The private validate_local_url!/2 guard in lib/phoenix_live_view.ex rejects leading double-slashes and backslashes but does not strip or reject these whitespace control characters; browsers silently discard them before URL resolution, so a payload such as /<TAB>/example.com validates as a local path yet resolves to the scheme-relative URL //example.com. Affected versions span three release trains: 0.5.0–1.0.18, 1.1.0-rc.0–1.1.32, and 1.2.0-rc.0–1.2.8. No public exploit code or CISA KEV listing has been identified at time of analysis.
URL scheme validation bypass in Phoenix LiveView 1.2.2–1.2.6 allows unauthenticated attackers to inject javascript: URLs that execute in a victim's browser session when clicked. The root cause is a first-byte ASCII letter guard in the internal uri_scheme/1 helper: inputs prefixed with whitespace or C0 control characters bypass scheme detection entirely and are treated as safe relative paths, while WHATWG-compliant browsers silently strip those leading bytes before parsing — converting what LiveView sees as a harmless string into an executable javascript: URL. Applications rendering user-supplied URLs (profile links, redirect targets, external references) via the <.link href={...}> component are directly affected; no public exploit code has been identified at time of analysis, and a patched release (1.2.7) is available.