Hanno's projects · Report #503922
Open redirect on the https://tt.hboeck.de
Validstatus
lowseverity
25upvotes
3 Mar 2019disclosed
Summary
Reporter discovered an open redirect in an installation of tt-rss (Tiny Tiny RSS).
While low impact, it was a valid issue. It's been reported to the tt-rss project and fixed there: https://git.tt-rss.org/fox/tt-rss/commit/c68ac04020d85a296c784de18f8def3f365f9f6a
How it was found
Hi Team!
Testing request:
POST /public.php?return=%2F HTTP/1.1 Host: tt.hboeck.de ........... op=login&login={….}&password={...}&profile=0
Vulnerable parameter: return
Method: POST -> GET -> OK
POC:
https://tt.hboeck.de/public.php?return=http%3a%2f%2fevil.com%2f&op=login&login=password=&profile=0
Impact
User can be redirect to malicious site.