Summary
Eclipse Adoptium's download page can redirect a visitor to an attacker-controlled URL because it validates the raw link parameter before browser URL normalization. A crafted adoptium.net link may therefore appear legitimate while causing the browser to download a malicious binary selected by the attacker.
Eclipse Adoptium's download page can redirect a visitor to an attacker-controlled URL because it validates the raw link parameter before browser URL normalization. A crafted adoptium.net link may therefore appear legitimate while causing the browser to download a malicious binary selected by the attacker.
Affected context
The issue affects Eclipse Adoptium website deployments built from the affected commit range when the localized download page processes a link query parameter and automatically navigates using a meta refresh. Risk arises when trusted URL prefixes are checked on the unnormalized input while the browser later applies RFC 3986 dot-segment normalization, potentially changing the effective destination.
The issue affects Eclipse Adoptium website deployments built from the affected commit range when the localized download page processes a link query parameter and automatically navigates using a meta refresh. Risk arises when trusted URL prefixes are checked on the unnormalized input while the browser later applies RFC 3986 dot-segment normalization, potentially changing the effective destination.
Exploit preconditions
- Attack surface: The public adoptium.net download page and its
linkquery parameter - Required access: No authenticated account is generally required; the attacker needs to distribute a crafted website link
- Trigger point: A victim visits the affected post-download page
- Why exploitation is possible: Prefix validation is performed on the raw URL, while browser navigation normalizes dot segments before requesting the destination
- Attack surface: The public adoptium.net download page and its
linkquery parameter - Required access: No authenticated account is generally required; the attacker needs to distribute a crafted website link
- Trigger point: A victim visits the affected post-download page
- Why exploitation is possible: Prefix validation is performed on the raw URL, while browser navigation normalizes dot segments before requesting the destination
Why this happens
The vulnerability results from validating a redirect destination as an unnormalized string and then delegating navigation to a browser with different URL resolution semantics. A URL can appear to begin with an approved prefix during the string comparison while resolving to a different host or path after normalization. This behavior maps primarily to CWE-601: URL Redirection to Untrusted Site, with download integrity concerns also relating to CWE-494: Download of Code Without Integrity Check.
The vulnerability results from validating a redirect destination as an unnormalized string and then delegating navigation to a browser with different URL resolution semantics. A URL can appear to begin with an approved prefix during the string comparison while resolving to a different host or path after normalization. This behavior maps primarily to CWE-601: URL Redirection to Untrusted Site, with download integrity concerns also relating to CWE-494: Download of Code Without Integrity Check.
Potential impact
- A victim may download an attacker-selected executable while viewing a legitimate-looking Adoptium page
- Attackers could use the trusted domain to increase phishing and social-engineering credibility
- Downloaded software may contain malware or other unwanted functionality
- Organizations could experience endpoint compromise if users execute the downloaded binary
- Trust in official software distribution workflows may be reduced
- A victim may download an attacker-selected executable while viewing a legitimate-looking Adoptium page
- Attackers could use the trusted domain to increase phishing and social-engineering credibility
- Downloaded software may contain malware or other unwanted functionality
- Organizations could experience endpoint compromise if users execute the downloaded binary
- Trust in official software distribution workflows may be reduced
General mitigation guidance
Mitigation generally focuses on eliminating ambiguous redirect validation and reducing trust in user-controlled destinations.
Common defensive patterns include:
- Parse and normalize URLs with a standards-compliant URL parser before validation
- Prefer an allowlist of exact, canonical hosts and approved paths over raw prefix checks
- Avoid redirecting directly to arbitrary user-supplied URLs when a server-side selection identifier can be used instead
- Require integrity metadata, such as cryptographic hashes or signatures, for downloadable binaries
- Use safe-by-default download flows that preserve trusted origins and clearly identify the final destination
- Apply least privilege and endpoint controls so downloaded programs cannot freely affect sensitive resources
Mitigation generally focuses on eliminating ambiguous redirect validation and reducing trust in user-controlled destinations.
Common defensive patterns include:
- Parse and normalize URLs with a standards-compliant URL parser before validation
- Prefer an allowlist of exact, canonical hosts and approved paths over raw prefix checks
- Avoid redirecting directly to arbitrary user-supplied URLs when a server-side selection identifier can be used instead
- Require integrity metadata, such as cryptographic hashes or signatures, for downloadable binaries
- Use safe-by-default download flows that preserve trusted origins and clearly identify the final destination
- Apply least privilege and endpoint controls so downloaded programs cannot freely affect sensitive resources
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying raw
startsWith()or substring checks on redirect URLs - Code review checks for redirects or download links derived from query parameters
- Tests covering dot-segment normalization, encoding variations, alternate URL forms, and host-boundary cases
- Browser-based integration tests that compare the validated URL with the browser's effective destination
- Policy enforcement requiring canonical URL parsing and exact-origin allowlists
- Monitoring for unusual download destinations, redirect chains, and binaries lacking expected signatures
Automated security review tools may help identify untrusted redirect flows, but manual validation of URL parsing behavior remains important.
Organizations can look for this class of issue through:
- Static analysis rules identifying raw
startsWith()or substring checks on redirect URLs - Code review checks for redirects or download links derived from query parameters
- Tests covering dot-segment normalization, encoding variations, alternate URL forms, and host-boundary cases
- Browser-based integration tests that compare the validated URL with the browser's effective destination
- Policy enforcement requiring canonical URL parsing and exact-origin allowlists
- Monitoring for unusual download destinations, redirect chains, and binaries lacking expected signatures
Automated security review tools may help identify untrusted redirect flows, but manual validation of URL parsing behavior remains important.
