A critical security vulnerability in Warpgate allows unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated user session, potentially compromising administrative access.

The application fails to properly neutralize input in the next parameter within the SSO provider endpoints, leading to stored cross-site scripting (XSS) and open redirect flaws. An unauthenticated attacker can craft a link that, when visited by a victim, executes malicious scripts within the authenticated Warpgate origin.

Successful exploitation allows an attacker to hijack user sessions or perform unauthorized actions on behalf of the victim. If an administrator is targeted, the attacker may gain full control over the bastion host, leading to unauthorized access to downstream SSH, HTTPS, or MySQL resources. Given the CVSS score of 9.3, this flaw poses a severe risk to organizational infrastructure security and data confidentiality.

Immediate Action: Upgrade Warpgate to version 0.25.5 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for suspicious redirect patterns or unusual API requests targeting the /@warpgate/api/sso/return endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection patterns in URL parameters.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the potential for administrative account takeover, necessitates an immediate update. Administrators should prioritize patching all instances of Warpgate to version 0.25.5 to eliminate the XSS and open redirect vectors. Ensure that all users are aware of the risks associated with clicking suspicious links, even those targeting internal services.