SickChill - Open Redirect

lowseverity

4.7CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.

Impact

Authenticated attackers can redirect users to malicious sites, potentially leading to phishing or information disclosure.

Fix

Update to the version containing commit c7128a8946c3701df95c285810eb75b2de18bf82 or later.

How to confirm it

Send: POST /login/?next=https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2024-53995 -u <target>

The full check

id: CVE-2024-53995

info:
  name: SickChill - Open Redirect
  author: omarkurt
  severity: low
  description: |
    SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.
  impact: |
    Authenticated attackers can redirect users to malicious sites, potentially leading to phishing or information disclosure.
  remediation: |
    Update to the version containing commit c7128a8946c3701df95c285810eb75b2de18bf82 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill/
    - https://vulnerabletarget.com/VT-2024-53995
    - https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33
    - https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82
    - https://github.com/SickChill/sickchill/pull/8811
    - https://nvd.nist.gov/vuln/detail/CVE-2024-53995
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2024-53995
    cwe-id: CWE-601
    epss-score: 0.01011
    epss-percentile: 0.63442
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"SickChill"
  tags: cve,cve2024,redirect,sickchill,vuln

http:
  - raw:
      - |
        POST /login/?next=https://interact.sh HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

References

Use this check only on systems you are authorised to test. Where the data comes from