XWiki - Open Redirect

mediumseverity

6.1CVSS score

53.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0.

Impact

An attacker can craft malicious URLs to redirect users to malicious websites.

Fix

Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.

How to confirm it

Send: GET {{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//oast.me
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?oast\.me(?:\s*…/

Run it with nuclei: nuclei -id CVE-2023-32068 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-32068

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0.
  impact: |
    An attacker can craft malicious URLs to redirect users to malicious websites.
  remediation: |
    Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-20096
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32068
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-32068
    cwe-id: CWE-601
    epss-score: 0.53818
    epss-percentile: 0.99006
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2023,xwiki,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?oast\.me(?:\s*?)$'

References

Use this check only on systems you are authorised to test. Where the data comes from