CyberRota Analysis
AI-GeneratedThe Webbox component of TeamDavid by Tobit Laboratories AG is vulnerable due to improper handling of user-supplied input in redirect URLs, allowing attackers to manipulate the redirect target in 302 HTTP responses. This can lead to phishing attacks by redirecting users to malicious domains that resemble the legitimate site, as well as the potential injection of arbitrary HTTP response headers. Organizations using TeamDavid up to Rollout 524 should prioritize addressing this vulnerability to mitigate risks associated with user redirection and header manipulation.
Original NVD Description
The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid through Rollout 524.