Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.
Impact
Phishing: Redirect users to fake login pages to steal credentials
Session Hijacking: Redirect to attacker site that captures session cookies via JavaScript
Malware Distribution: Redirect to sites hosting malware or drive-by downloads
Reputation Damage: Users lose trust when redirected to malicious sites from legitimate application
Social Engineering: Use trusted Snipe-IT domain to increase phishing success rate
When the user clicks "Save", the application:
Processes the form
Checks redirect_option (if set to 'back')
Calls Helper::getRedirectOption()
Retrieves back_url from session: https://evil.com/phishing?target=snipeit
Executes redirect()->to($backUrl)
User is redirected to attacker's site
This would still require session poisoning, so the actual practical threat here is minimal.