0xsu3ks/cve-2024-34328Proof-of-concept for open redirection via Host header manipulation in Sielox AnyWare 2.1.2 (CVE-2024-34328), with exploit steps, impact, and mitigation guidance.
Vulnerability Title: Open Redirection via Host Header
Product: Sielox AnyWare
Version Affected: 2.1.2
CVE ID: CVE-2024-34328
Severity: Medium
Attack Vector: Remote
Impact: Open Redirection / Phishing
An attacker can craft a URL with a modified Host header that points to a malicious domain under their control. When users click the malicious link, they are redirected to the attacker's domain — potentially leading to phishing, credential theft, or malware delivery.
This vulnerability arises due to the application’s improper validation of the Host header when generating absolute URLs during redirection.
Below are two images demonstrating the exploit process:
Step 1: Malicious URL crafted using the Host header
Step 2: Victim is redirected to an attacker-controlled domain
Host header server-side.Successful exploitation may allow attackers to:
Security Researcher – Kevin Suckiel // 0xsu3ks
This research is for educational purposes and responsible disclosure. The author is not liable for any misuse of this information.