CVE-2024-52875

CVE-2024-52875 is an HTTP response splitting flaw (CWE-113) in GFI Kerio Control 9.2.5 through 9.4.5, where the unauthenticated 'dest' GET parameter on the /nonauth/addCertException.cs, /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is placed into the Location header of a 302 redirect without sanitization. An attacker triggers it by convincing a user to open a crafted link containing CRLF sequences in the 'dest' parameter, which yields open redirects, HTTP response splitting, and reflected cross-site scripting. Beyond XSS, the flaw can be escalated to remote command execution by abusing the upgrade feature in the Kerio Control admin interface, as demonstrated in published research. Any organization running Kerio Control 9.2.5 through 9.4.5 — typically SMB firewall/VPN gateway appliances or virtual appliances — is affected. No confirmed in-the-wild exploitation is documented and the issue is not in CISA KEV, but two public proofs of concept exist and a 29.6% EPSS score (98th percentile) indicates a high likelihood of exploitation attempts within 30 days.

What to do: Upgrade Kerio Control to a release later than 9.4.5, which resolves this issue. Until patched, minimize internet exposure of the Kerio Control admin and /nonauth/ pages (restrict management access to trusted networks) and treat any emailed or linked URLs pointing to the appliance's addCertException.cs, guestConfirm.cs or expiration.cs pages as untrusted. Monitor the appliance for unexpected upgrade activity or admin-interface sessions, since the known escalation path runs through the admin upgrade feature.