+++ This bug was initially created as a clone of Bug #1961337 +++
Copied from the upstream bug [1]:
"This bug report is related to Security.
Currently novnc is allowing open direction, which could potentially be used for phishing attempts
To test.
https://<sites' vnc domain>//example.com/%2F..
include .. at the end
For example:
http://vncproxy.my.domain.com//example.com/%2F..
It will redirect to example.com. You can replace example.com with some legitimate domain or spoofed domain.
The description of the risk is
By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
Because the server name in the modified link is identical to the original site, phishing attempts may have a more trustworthy appearance."
[1] https://bugs.launchpad.net/nova/+bug/1927677
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Release of components for Red Hat OpenStack Platform 17.0 (Wallaby)), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2022:6543