Alfresco Share - Open Redirect

mediumseverity

6.1CVSS score

4.5%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can trick users into visiting a malicious website, leading to potential phishing attacks or the disclosure of sensitive information.

Fix

Apply the latest security patches or updates provided by Alfresco to fix the open redirect vulnerability.

How to confirm it

Send: POST {{BaseURL}}/share/page/dologin
Positive when: matches in header /(?m)^(?:Location\s*:\s*)(?:https?://|//|\\)?(?:[a-zA-Z0-9\-_]*\.)?interact\.sh(…/

Run it with nuclei: nuclei -id CVE-2019-14223 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-14223

info:
  name: Alfresco Share - Open Redirect
  author: pdteam
  severity: medium
  description: Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can trick users into visiting a malicious website, leading to potential phishing attacks or the disclosure of sensitive information.
  remediation: |
    Apply the latest security patches or updates provided by Alfresco to fix the open redirect vulnerability.
  reference:
    - https://community.alfresco.com/content?filterID=all~objecttype~thread%5Bquestions%5D
    - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14223-Open%20Redirect%20in%20Alfresco%20Share-Alfresco%20Community
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14223
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Elsfa7-110/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-14223
    cwe-id: CWE-601
    epss-score: 0.04474
    epss-percentile: 0.91534
    cpe: cpe:2.3:a:alfresco:alfresco:*:*:*:*:community:*:*:*
  metadata:
    max-request: 1
    vendor: alfresco
    product: alfresco
  tags: cve,cve2019,redirect,alfresco,vkev,vuln

http:
  - method: POST
    path:
      - '{{BaseURL}}/share/page/dologin'

    body: |
      success=%2Fshare%2Fpage%2F&failure=:\\interact.sh&username=baduser&password=badpass

    headers:
      Content-Type: application/x-www-form-urlencoded
    matchers:
      - type: regex
        part: header
        regex:
          - "(?m)^(?:Location\\s*:\\s*)(?:https?://|//|\\\\)?(?:[a-zA-Z0-9\\-_]*\\.)?interact\\.sh(?:\\s*)$"

References

Use this check only on systems you are authorised to test. Where the data comes from