An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic

Overview

An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.

Affected

• mautic/core >= 1.0.0-beta < 5.2.12
• mautic/core >= 6.0.0 < 6.0.10
• mautic/core >= 7.0.0 < 7.2.2

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

There are no official workarounds. To mitigate this vulnerability without upgrading, configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own websites.