Skip to content
Nuclei Templates

OPNsense <=20.1.5 - Open Redirect

ID: CVE-2020-23015

Severity: medium

Author: 0x_Akoko

Tags: cve2020,cve,redirect,opnsense

Description

Section titled “Description”

OPNsense through 20.1.5 contains an open redirect vulnerability via the url redirect parameter in the login page, which is not filtered. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

Section titled “YAML Source”
id: CVE-2020-23015


info:
  name: OPNsense <=20.1.5 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: OPNsense through 20.1.5 contains an open redirect vulnerability via the url redirect parameter in the login page, which is not filtered. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to redirect users to malicious websites, leading to phishing attacks or the disclosure of sensitive information.
  remediation: |
    Upgrade OPNsense to a version higher than 20.1.5 to mitigate the vulnerability.
  reference:
    - https://github.com/opnsense/core/issues/4061
    - https://nvd.nist.gov/vuln/detail/CVE-2020-23015
    - https://github.com/anonymous364872/Rapier_Tool
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/StarCrossPortal/scalpel
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-23015
    cwe-id: CWE-601
    epss-score: 0.00179
    epss-percentile: 0.55016
    cpe: cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: opnsense
    product: opnsense
    shodan-query: http.title:"opnsense"
    fofa-query: title="opnsense"
    google-query: intitle:"opnsense"
  tags: cve2020,cve,redirect,opnsense


http:
  - method: GET
    path:
      - '{{BaseURL}}/?url=http://interact.sh'


    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(?:\s*?)$'
# digest: 490a004630440220491ef13299af55c933af7c0a6ed740561a7ac3d67c63895a907c63b6ba1cd23702204ccba0ccbdb67d5fb39a70b7def601796b86a68cfe7ceeb7b47c87e13fcf29ef:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-23015.yaml"

View on Github