OpenCATS - Open Redirect

ID: CVE-2023-27292

Severity: medium

Author: r3Y3r53

Tags: cve2023,cve,authenticated,tenable,opencats,redirect

Description

OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations.

YAML Source

id: CVE-2023-27292

info:
  name: OpenCATS - Open Redirect
  author: r3Y3r53
  severity: medium
  description: |
    OpenCATS contains an open redirect vulnerability due to improper validation of user-supplied GET parameters. This, in turn, exposes OpenCATS to possible template injection and obtaining sensitive information, modifying data, and/or executing unauthorized operations.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or the download of malware.
  remediation: |
    Apply the latest patch or update to the latest version of OpenCATS to fix the open redirect vulnerability.
  reference:
    - https://www.tenable.com/security/research/tra-2023-8
    - https://nvd.nist.gov/vuln/detail/CVE-2023-27292
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-27292
    cwe-id: CWE-601
    epss-score: 0.00092
    epss-percentile: 0.39168
    cpe: cpe:2.3:a:opencats:opencats:0.9.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: opencats
    product: opencats
    shodan-query:
      - title:"opencats"
      - http.title:"opencats"
    fofa-query: title="opencats"
    google-query: intitle:"opencats"
  tags: cve2023,cve,authenticated,tenable,opencats,redirect

http:
  - raw:
      - |
        POST /index.php?m=login&a=attemptLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}
      - |
        GET /index.php?m=settings&a=previewPage&url=https://oast.me HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<TITLE>Page Preview</TITLE>'
          - '<FRAME src="https://oast.me">'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450220030341e7974edfaf72db5eb291587db516a7d999e8bab2b4a925424e6ede655f022100a9578ca96c31dab75c1f792559dc7993a9035268018abfaf1cb94f538f4bf667:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-27292.yaml"

View on Github