CVE-2022-39183

What it actually does

The SAML authentication plugin fails to validate or restrict redirect targets, allowing an attacker-supplied URL to be accepted during the authentication response flow and causing the browser to be sent to an arbitrary external site.

Why it matters to the business

Users can be silently redirected to attacker-controlled pages that mimic login or other trusted interfaces, increasing the chance of credential theft or malware distribution with minimal user interaction required.

How an attack unfolds

An attacker crafts a link containing a malicious redirect destination, delivers it via phishing or another channel, and the victim who follows the link through the SAML login flow is sent to the attacker site after the authentication step completes.

How to fix it

Upgrade the SAML authentication plugin to the latest patched release that enforces an allow-list of permitted redirect domains; if no update is available, temporarily disable the plugin or add server-side validation of all redirect parameters before issuing the redirect.

How to confirm the fix worked

Review the installed SAML plugin version against the vendor advisory, attempt to trigger an open redirect with a test URL containing an external domain, and confirm that only approved internal or same-origin redirects are honored after the fix.

Typical attack path

1. Identify a Moodle instance using the vulnerable SAML auth plugin
2. Craft a URL that supplies an attacker-controlled redirect target in the SAML response or RelayState parameter
3. Deliver the link to targeted users through email, chat, or other channels
4. Victim follows the link and completes or initiates SAML authentication
5. Browser is redirected to the attacker site, enabling phishing or drive-by attacks

How to detect it

Inspect web server and application logs for SAML authentication requests or responses that contain redirect or RelayState parameters pointing to external domains not belonging to the organization; correlate with user reports of unexpected redirects after login attempts.

What your security team should do

• Prioritize updating the SAML authentication plugin as soon as a fixed version is released
• Implement a temporary WAF or proxy rule that blocks or logs SAML responses containing external redirect targets
• Educate users to verify URLs before entering credentials on any redirected page
• Monitor authentication logs for redirect parameters pointing outside the organization's domains