Summary
Payload CMS may forward authentication data when retrieving an authenticated external URL that redirects to a destination not verified as trusted. An attacker who can influence the requested URL or redirect chain may cause a valid session credential to reach an unintended recipient, potentially enabling account or API access.
Payload CMS may forward authentication data when retrieving an authenticated external URL that redirects to a destination not verified as trusted. An attacker who can influence the requested URL or redirect chain may cause a valid session credential to reach an unintended recipient, potentially enabling account or API access.
Affected context
The issue affects Payload CMS deployments using authenticated external URL-based upload retrieval in versions after 3.0.0 and before 3.90.0. Risk depends on whether an attacker can influence the external URL or redirect destination and whether authentication data is attached during retrieval.
The issue affects Payload CMS deployments using authenticated external URL-based upload retrieval in versions after 3.0.0 and before 3.90.0. Risk depends on whether an attacker can influence the external URL or redirect destination and whether authentication data is attached during retrieval.
Exploit preconditions
- Attack surface: External URL-based upload retrieval
- Required access: Ability to submit, influence, or trigger retrieval of an external upload URL, depending on application authorization
- Trigger point: Processing an external URL that redirects during authenticated retrieval
- Why exploitation is possible: The redirected destination is not adequately verified before authentication data is forwarded
- Attack surface: External URL-based upload retrieval
- Required access: Ability to submit, influence, or trigger retrieval of an external upload URL, depending on application authorization
- Trigger point: Processing an external URL that redirects during authenticated retrieval
- Why exploitation is possible: The redirected destination is not adequately verified before authentication data is forwarded
Why this happens
The underlying issue is insufficient origin validation during HTTP redirect handling. The upload retrieval flow may preserve authentication data across a redirect without confirming that the destination remains within an approved trust boundary. This maps primarily to CWE-346: Origin Validation Error, with CWE-200: Exposure of Sensitive Information describing the resulting disclosure of session or authentication data.
The underlying issue is insufficient origin validation during HTTP redirect handling. The upload retrieval flow may preserve authentication data across a redirect without confirming that the destination remains within an approved trust boundary. This maps primarily to CWE-346: Origin Validation Error, with CWE-200: Exposure of Sensitive Information describing the resulting disclosure of session or authentication data.
Potential impact
- Authentication data may be exposed to an unintended external recipient
- An attacker could potentially reuse a disclosed session or credential
- Unauthorized access to protected Payload CMS resources may occur
- Confidential upload or application data could be accessed or modified
- Authentication data may be exposed to an unintended external recipient
- An attacker could potentially reuse a disclosed session or credential
- Unauthorized access to protected Payload CMS resources may occur
- Confidential upload or application data could be accessed or modified
General mitigation guidance
Mitigation generally focuses on enforcing trusted-origin boundaries during external retrieval.
Common defensive patterns include:
- Restricting redirects to explicitly approved origins and schemes
- Avoiding forwarding authentication headers or cookies across origin changes
- Revalidating the final destination after every redirect
- Separating credentials used for external retrieval from user session credentials
- Applying least-privilege scopes and short-lived tokens where authentication is required
- Rejecting ambiguous, malformed, or cross-origin redirect targets by default
Mitigation generally focuses on enforcing trusted-origin boundaries during external retrieval.
Common defensive patterns include:
- Restricting redirects to explicitly approved origins and schemes
- Avoiding forwarding authentication headers or cookies across origin changes
- Revalidating the final destination after every redirect
- Separating credentials used for external retrieval from user session credentials
- Applying least-privilege scopes and short-lived tokens where authentication is required
- Rejecting ambiguous, malformed, or cross-origin redirect targets by default
How teams detect issues like this
Organizations can look for:
- Static analysis rules covering redirect handling and credential propagation
- Code review signals where cookies, authorization headers, or session tokens follow redirects
- Tests that exercise cross-origin, multi-hop, scheme-changing, and user-controlled redirects
- Network policy monitoring for authenticated requests to unexpected domains
- CI security policies requiring explicit destination allowlists for external fetches
Automated application security and code review tools may help identify unsafe redirect and origin-validation patterns.
Organizations can look for:
- Static analysis rules covering redirect handling and credential propagation
- Code review signals where cookies, authorization headers, or session tokens follow redirects
- Tests that exercise cross-origin, multi-hop, scheme-changing, and user-controlled redirects
- Network policy monitoring for authenticated requests to unexpected domains
- CI security policies requiring explicit destination allowlists for external fetches
Automated application security and code review tools may help identify unsafe redirect and origin-validation patterns.
