BlogEngine CMS - Open Redirect

ID: CVE-2023-33405

Severity: medium

Author: Shankar Acharya

Tags: cve2023,cve,Blogengine,cms,redirect,blogengine

Description

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect

YAML Source

id: CVE-2023-33405

info:
  name: BlogEngine CMS - Open Redirect
  author: Shankar Acharya
  severity: medium
  description: |
    Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect
  remediation: |
    Update to the latest version of blogengine.net CMS  to fix the open redirect vulnerability.
  reference:
    - https://github.com/hacip/CVE-2023-33405
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33405
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-33405
    cwe-id: CWE-601
    epss-score: 0.00071
    epss-percentile: 0.29221
    cpe: cpe:2.3:a:blogengine:blogengine.net:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: blogengine
    product: blogengine.net
    shodan-query: http.html:"blogengine.net"
    fofa-query: body="blogengine.net"
  tags: cve2023,cve,Blogengine,cms,redirect,blogengine

http:
  - method: GET
    path:
      - "{{BaseURL}}/default.aspx?years=http://oast.pro"

    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
        part: header
# digest: 4b0a00483046022100a22b6a6939f3710fa5fd3c7ae74cc4d8c1a56c686e67785055adc93eafc99502022100904654adba45daf8fc55fc81d581eb55bcb8b387cf97580f3802aafdd1aec89c:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-33405.yaml"

View on Github