The AdonisJS HTTP Server package contains an open redirect vulnerability (CWE-601) in the response.redirect().back() method, which reads the Referer header from incoming HTTP requests and redirects users to that URL without validating the host. This allows attackers who can control the Referer header to redirect users to untrusted external sites. The issue affects @adonisjs/http-server versions prior to 7.8.1 and from 8.0.0-next.0 up to 8.1.3, and @adonisjs/core versions prior to 7.4.0. The vulnerability has been addressed in versions 7.8.1 and 8.2.0 of @adonisjs/http-server and 7.4.0 of @adonisjs/core.

Successful exploitation can lead to users being redirected to malicious external websites, potentially facilitating phishing or other social engineering attacks. The vulnerability does not directly impact confidentiality or availability but can lead to limited confidentiality and integrity impacts due to user redirection. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

This vulnerability has been fixed in @adonisjs/http-server versions 7.8.1 and 8.2.0 and in @adonisjs/core version 7.4.0. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly stated in the vendor advisory content provided, but the fixed versions are clearly identified. Until upgrading, avoid using response.redirect().back() or ensure proper validation of the Referer header before redirecting.