Skip to content

WordPress Upward Themes <1.5 - Open Redirect

ID: wp-upward-theme-redirect

Severity: medium

Author: r3Y3r53

Tags: wordpress,wp-theme,wp,upward,redirect

WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

id: wp-upward-theme-redirect
info:
name: WordPress Upward Themes <1.5 - Open Redirect
author: r3Y3r53
severity: medium
description: |
WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
reference:
- https://cxsecurity.com/issue/WLB-2020030133
metadata:
verified: true
max-request: 1
google-query: inurl:"/wp-content/themes/Upward/"
tags: wordpress,wp-theme,wp,upward,redirect
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/themes/Upward/go.php?https://interact.sh"
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
# digest: 4a0a00473045022100fa3506b7163f77d9c92e052257028e5e2aacda1c23895b192b6b200004be862302205acd138fb33b68e1247392a6906c6b09c6006927d2487ddac7873b69e434291f:922c64590222798bb761d5b6d8e72950

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/wp-upward-theme-redirect.yaml"

View on Github