Open Redirect on nopCommerce 4.50.1

Date: 19/03/2022

Exploit Author: Tin Pham aka TF1T of VietSunshine Cyber Security Services

Vendor Homepage: https://www.nopcommerce.com/

Version: nopCommerce 4.50.1 (and prior)

CVE: CVE-2022-27461

Description: In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring user to authenticate to nopCommerce page by clicking on a crafted link.

Steps to reproduce: After a successful login of victim, the user will be redirected to https://example.com when the following link is being clicked: https: //$IP/login?returnurl=https://example.com