HomeAutomation 3.3.2 - Open Redirect

mediumseverity

6.1CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

HomeAutomation 3.3.2 contains a redirect vulnerability caused by improper verification of the 'redirect' GET parameter in 'api.php', letting attackers redirect users to arbitrary websites, exploit requires user interaction with a crafted link.

Impact

Attackers can redirect users to malicious external websites through crafted links, potentially facilitating phishing attacks or malware distribution.

Fix

Upgrade to HomeAutomation version 3.3.3 or later, or apply vendor-provided security patches.

How to confirm it

Send: GET {{BaseURL}}/homeautomation_v3_3_2/api.php?do=groups/toggle&groupid=1&status=1&redirect=https://interact.sh/
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2020-21998 -u <target>

The full check

id: CVE-2020-21998

info:
  name: HomeAutomation 3.3.2 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
    HomeAutomation 3.3.2 contains a redirect vulnerability caused by improper verification of the 'redirect' GET parameter in 'api.php', letting attackers redirect users to arbitrary websites, exploit requires user interaction with a crafted link.
  impact: |
    Attackers can redirect users to malicious external websites through crafted links, potentially facilitating phishing attacks or malware distribution.
  remediation: |
    Upgrade to HomeAutomation version 3.3.3 or later, or apply vendor-provided security patches.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5559.php
    - https://packetstormsecurity.com/files/155795/HomeAutomation-3.3.2-Open-Redirect.html
    - https://cxsecurity.com/issue/WLB-2019120132
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-21998
    cwe-id: CWE-601
    epss-score: 0.01319
    epss-percentile: 0.71076
    cpe: cpe:2.3:a:homeautomation_project:homeautomation:3.3.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: homeautomation_project
    product: homeautomation
  tags: cve,cve2020,homeautomation,packetstorm,iot,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/homeautomation_v3_3_2/api.php?do=groups/toggle&groupid=1&status=1&redirect=https://interact.sh/"

    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header

References

Use this check only on systems you are authorised to test. Where the data comes from