Gitea: Open Redirect via redirect_to

Details

Despite the validation within urlIsRelative in modules/httplib/url.go, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter.

PoC

When a user uses this URL to login:

https://gitea.com/user/login?redirect_to=/a/../\example.com

They would be redirected to example.com upon a successful login to their gitea account.

Impact

• Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
• OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect
• Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header
• Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users