nuclei-templates/vulnerabilities/wordpress/wp-security-open-redirect.yaml

id: wp-security-open-redirect

info:
  name: WordPress All-in-One Security <=4.4.1 - Open Redirect
  author: akincibor
  severity: medium
  description: |
    WordPress All-in-One Security plugin through 4.4.1 contains an open redirect vulnerability which can expose the actual URL of the hidden login page feature. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  remediation: Upgrade to 4.4.2 or later.
  reference:
    - https://wpscan.com/vulnerability/9898
    - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-all-in-one-wp-security-firewall-open-redirect-4-4-1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-601
  metadata:
    verified: true
  tags: wp-plugin,redirect,wordpress,wp,wpscan

requests:
  - method: GET
    path:
      - "{{BaseURL}}/?aiowpsec_do_log_out=1&after_logout=https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

# Enhanced by md on 2022/10/19
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00			`id: wp-security-open-redirect`

			`info:`
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements 2022-10-19 21:11:27 +00:00			`name: WordPress All-in-One Security <=4.4.1 - Open Redirect`
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00			`author: akincibor`
Dashboard Content Enhancements (#6598) Dashboard Content Enhancements 2023-01-23 22:14:23 +00:00			`severity: medium`
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00			`description: \|`
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements 2022-10-19 21:11:27 +00:00			`WordPress All-in-One Security plugin through 4.4.1 contains an open redirect vulnerability which can expose the actual URL of the hidden login page feature. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.`
			`remediation: Upgrade to 4.4.2 or later.`
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00			`reference:`
			`- https://wpscan.com/vulnerability/9898`
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements 2022-10-19 21:11:27 +00:00			`- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-all-in-one-wp-security-firewall-open-redirect-4-4-1`
			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
			`cvss-score: 6.1`
			`cwe-id: CWE-601`
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00			`metadata:`
			`verified: true`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`tags: wp-plugin,redirect,wordpress,wp,wpscan`
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00
			`requests:`
			`- method: GET`
			`path:`
Fixed possible FPs in open redirect templates (#4544) * Fixed possible FPs in open redirect templates We have replaced example.com with interact.sh since few domains redirect to example.com, which results in FP results. * updated example domain Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-06-06 10:40:15 +00:00			`- "{{BaseURL}}/?aiowpsec_do_log_out=1&after_logout=https://interact.sh"`
Create wp-security-open-redirect.yaml 2022-05-10 09:03:03 +00:00
			`matchers:`
			`- type: regex`
			`part: header`
			`regex:`
Reduce false-positives in open-redirect regexes 2023-03-01 08:39:14 +00:00			`- '(?m)^(?:Location\s?:\s?)(?:https?:\/\/\|\/\/\|\/\\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@])interact\.sh\/?(\/\|[^.].)?$' # https://regex101.com/r/L403F0/1`
Dashboard Content Enhancements (#5704) Dashboard Content Enhancements 2022-10-19 21:11:27 +00:00
			`# Enhanced by md on 2022/10/19`