/CVE-2023-0748

BTCPayServer version 1.7.5 and below is vulnerable for Open Redirection attack.

CVE-2023-0748

BTCPayServer 1.7.5 and lower version is vulnerable for Open Redirection attack.

Step to Reproduce

  1. Login your account on

https://mainnet.demo.btcpayserver.org/login

  1. Then Click the link below

https://mainnet.demo.btcpayserver.org/recovery-seed-backup?cryptoCode=BTC&mnemonic=above&passphrase=&isStored=false&requireConfirm=true&returnUrl=//evil.com

  1. Check the I have written down my recovery phrase and stored it in a secure location

  2. Then click Done

You will be redirected to evil.com



Credits

• Jefferson Gonzales (Gonz)
• Link: https://twitter.com/gonzxph