Telaen => v1.3.1 - Open Redirect

mediumseverity

6.1CVSS score

10.7%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.

Fix

Upgrade to the latest version of Telaen to fix the open redirect vulnerability.

How to confirm it

Send: GET {{BaseURL}}/telaen/redir.php?https://interact.sh ; GET {{BaseURL}}/redir.php?https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2013-2621 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2013-2621

info:
  name: Telaen => v1.3.1 - Open Redirect
  author: ctflearner
  severity: medium
  description: |
    Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.
  remediation: |
    Upgrade to the latest version of Telaen to fix the open redirect vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/38546
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/84683
    - https://nvd.nist.gov/vuln/detail/CVE-2013-2621
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2013-2621
    cwe-id: CWE-601
    epss-score: 0.10692
    epss-percentile: 0.95848
    cpe: cpe:2.3:a:telaen_project:telaen:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: telaen_project
    product: telaen
  tags: cve2013,cve,telaen,redirect,telaen_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/telaen/redir.php?https://interact.sh"
      - "{{BaseURL}}/redir.php?https://interact.sh"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

References

Use this check only on systems you are authorised to test. Where the data comes from