Uncanny Toolkit for LearnDash - Open Redirection

mediumseverity

4.7CVSS score

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security.

Impact

Unauthenticated attackers can craft malicious redirect URLs through the REST API to redirect LearnDash users to phishing sites, potentially stealing login credentials and compromising user accounts.

Fix

Update Uncanny Toolkit for LearnDash plugin to version 3.6.4.4 or later that validates redirect URLs and prevents open redirect attacks in the REST API.

How to confirm it

Send: GET {{BaseURL}}/?rest_route=/ult/v2/review-banner-visibility&action=maybe-later&redirect=yes&redirect_url=https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/

Run it with nuclei: nuclei -id CVE-2023-34020 -u <target>

The full check

id: CVE-2023-34020

info:
  name: Uncanny Toolkit for LearnDash - Open Redirection
  author: LeDoubleTake
  severity: medium
  description: |
    A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security.
  impact: |
    Unauthenticated attackers can craft malicious redirect URLs through the REST API to redirect LearnDash users to phishing sites, potentially stealing login credentials and compromising user accounts.
  remediation: |
    Update Uncanny Toolkit for LearnDash plugin to version 3.6.4.4 or later that validates redirect URLs and prevents open redirect attacks in the REST API.
  reference:
    - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redirection-vulnerability
    - https://wordpress.org/plugins/uncanny-learndash-toolkit/
    - https://patchstack.com/database/vulnerability/uncanny-learndash-toolkit/wordpress-uncanny-toolkit-for-learndash-plugin-3-6-4-3-open-redirection-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
    cvss-score: 4.7
    cve-id: CVE-2023-34020
    cwe-id: CWE-601
    epss-score: 0.00971
    epss-percentile: 0.62207
    cpe: cpe:2.3:a:uncannyowl:uncanny_toolkit_for_learndash:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/uncanny-learndash-toolkit/"
    product: uncanny_toolkit_for_learndash
    vendor: uncannyowl
  tags: cve2023,cve,wordpress,uncanny-learndash-toolkit,wpscan,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?rest_route=/ult/v2/review-banner-visibility&action=maybe-later&redirect=yes&redirect_url=https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'

References

Use this check only on systems you are authorised to test. Where the data comes from