Summary

An open redirect vulnerability has been identified in the DataHub frontend /authenticate endpoint that could allow attackers to redirect users to malicious external sites.

Vulnerability Details

Root Cause

The vulnerability exists in AuthenticationController.java (line 148) where the redirect_uri query parameter is passed directly to Results.redirect() without proper validation.

Attack Vector

When the redirect URI contains triple slashes (e.g., ///google.com), URL normalization causes browsers to interpret this as a fully qualified external URL (https://google.com), bypassing intended redirect restrictions.

Example Request:

GET /authenticate?redirect_uri=///google.com HTTP/2
Host: demo.datahub.com

Impact

Attackers can craft malicious links to redirect authenticated users to phishing sites or malicious domains.

Patches

A fix has been developed and is available in the following pull request:

• #16279

Users should upgrade to the patched version once released.

Workarounds

Until the patch can be applied, consider the following temporary mitigations:

1. Web Application Firewall (WAF): Block requests to /authenticate containing redirect_uri parameters with multiple leading slashes (// or more)
2. Reverse Proxy Rules: Implement URL filtering at the reverse proxy level to reject malformed redirect parameters
3. User Education: Warn users to verify URLs before clicking authentication links
4. Network Monitoring: Monitor for suspicious redirect patterns in access logs

References

• Vulnerable Code: https://github.com/datahub-project/datahub/blob/master/datahub-frontend/app/controllers/AuthenticationController.java#L148
• Fix PR: #16279
• CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
• OWASP: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/04-Testing_for_Client-side_URL_Redirect