Vulnonym.com

CVE-2026-25956 - Boundless Impress

Description

Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://github.com/frappe/frappe/commit/22cac9dd240dc1fa00d4bab7e3887b70faf22bd1 https://github.com/frappe/frappe/security/advisories/GHSA-7m8v-g2pr-h2f7

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Base Score

6.1

Base Severity

MEDIUM

Remediation Guide for Frappe Open Redirect / Reflected XSS Vulnerability

  1. Identify Current Version:
    Check the version of Frappe currently deployed in your environment by running: 
    bench --version

    or inspecting the frappe package version in your requirements.txt or apps/frappe/VERSION.

  2. Upgrade Frappe to a Patched Version:
    Upgrade to at least version 14.99.14 (for v14) or 15.94.0 (for v15): 
    bench update --patch

    Alternatively, if using a specific branch:

    bench --site [your-site-name] update --patch
  3. Verify Upgrade Success:
    Confirm the upgraded version is installed: 
    bench --site [your-site-name] list-apps

    Ensure Frappe shows version 14.99.14 or higher, or 15.94.0 or higher.

  4. Validate Redirect Behavior:
    Test the signup flow by manually crafting a malicious URL with redirect parameters (e.g., ?redirect_to=http://malicious-site.com).
    Confirm the application now validates and sanitizes redirect URLs — no unauthorized redirects or script execution should occur.

  5. Review Custom Plugins/Modules:
    If custom apps or hooks extend Frappe’s signup functionality, ensure they do not propagate unsanitized redirect parameters. Audit all instances of redirect_to or similar URL parameters.

  6. Implement Input Validation and Output Encoding:
    Ensure all user-supplied URLs in signup flows are validated against a whitelist of trusted domains. Use Frappe’s built-in URL validation utilities (e.g., frappe.utils.validate_url). Avoid direct reflection of user input into HTTP headers or HTML contexts.

  7. Deploy Web Application Firewall (WAF) Rules:
    Temporarily deploy WAF rules to block requests containing suspicious redirect parameters (e.g., redirect_to=javascript:, http:// from untrusted sources) until patching is complete.

  8. Monitor and Log:
    Enable audit logging for login/signup requests with redirect parameters. Monitor for repeated attempts to exploit open redirects or XSS payloads.

  9. Notify Users (if applicable):
    If user data may have been exposed, notify users to change passwords and review account activity.

  10. Document and Retest:
    Update your incident response documentation with this vulnerability and remediation steps. Perform penetration testing or automated scanning to confirm the fix is effective.

Context within ISO/IEC 27001 and NIST Frameworks

ISO/IEC 27001 Control Mapping

This vulnerability maps to the following ISO/IEC 27001:2022 controls:

  • A.9.4.2 — Restriction of access rights: Unauthorized URL redirection can lead to unauthorized access paths or credential harvesting.
  • A.12.6.1 — Technical vulnerability management: Failure to patch known vulnerabilities exposes the system to exploitation.
  • A.14.2.5 — Secure development policy: Lack of input validation and secure coding practices during development enables open redirect/reflected XSS.
  • A.18.2.4 — Monitoring of systems and services: Inadequate logging or monitoring allows exploitation to go undetected.

NIST SP 800-53 Control Mapping

This vulnerability aligns with the following NIST controls:

  • SI-2 — System and Communications Protection: Prevents exploitation of vulnerabilities in web application input handling.
  • SI-3 — Vulnerability Scanning: Requires regular scanning to detect unpatched systems.
  • SI-4 — Security Assessment and Authorization: Ensures applications are tested for injection and redirect flaws before deployment.
  • SI-10 — Information Input Validation: Directly addresses improper handling of user-supplied URLs leading to open redirects and XSS.
  • AU-6 — Audit Log Monitoring: Supports detection of malicious signup attempts involving crafted URLs.

Recommendation: Apply patches immediately under SI-2 and SI-10. Integrate automated vulnerability scanning into CI/CD pipelines per SI-4 to prevent recurrence.