SINEMA Remote Connect Server < V2.0 - Open Redirect

mediumseverity

6.1CVSS score

4.7%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to potential phishing attacks.

Fix

Upgrade to SINEMA Remote Connect Server version 2.0 or later to fix the open redirect vulnerability.

How to confirm it

Send: GET /wbm/login/?next=https%3A%2F%2Finteract.sh ; POST /wbm/login/?next=https%3A%2F%2Finteract.sh
Positive when: matches in header_2 /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]…/

Run it with nuclei: nuclei -id CVE-2022-23102 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-23102

info:
  name: SINEMA Remote Connect Server < V2.0 - Open Redirect
  author: ctflearner,ritikchaddha
  severity: medium
  description: |
    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to potential phishing attacks.
  remediation: |
    Upgrade to SINEMA Remote Connect Server version 2.0 or later to fix the open redirect vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/cve-2022-23102
    - https://packetstormsecurity.com/files/165966/SIEMENS-SINEMA-Remote-Connect-1.0-SP3-HF1-Open-Redirection.html
    - https://seclists.org/fulldisclosure/2022/Feb/20
    - https://cert-portal.siemens.com/productcert/pdf/ssa-654775.pdf
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-23102
    cwe-id: CWE-601
    epss-score: 0.04718
    epss-percentile: 0.91907
    cpe: cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: siemens
    product: sinema_remote_connect_server
    shodan-query:
      - title:"Logon - SINEMA Remote Connect"
      - http.title:"logon - sinema remote connect"
    fofa-query: title="logon - sinema remote connect"
    google-query: intitle:"logon - sinema remote connect"
  tags: cve,cve2022,packetstorm,seclists,redirect,sinema,authenticated,siemens,vuln

http:
  - raw:
      - |
        GET /wbm/login/?next=https%3A%2F%2Finteract.sh HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /wbm/login/?next=https%3A%2F%2Finteract.sh HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: csrftoken={{csrf}};
        Referer: {{RootURL}}/wbm/login/?next=https%3A%2F%2Finteract.sh

        csrfmiddlewaretoken={{csrf}}&utcoffset=330&username={{username}}&password={{password}}

    matchers:
      - type: regex
        part: header_2
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'

    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - "name='csrfmiddlewaretoken' value='(.*)' />"
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from