2022-01-25 11:44:00 +00:00
id : CVE-2021-24838
info :
2022-08-06 11:35:13 +00:00
name : AnyComment < 0.3.5 - Open Redirect
2022-01-25 11:44:00 +00:00
author : noobexploiter
severity : medium
2022-08-10 08:17:42 +00:00
description : |
The plugin has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
2022-08-25 08:56:24 +00:00
reference :
2022-01-25 11:44:00 +00:00
- https://wpscan.com/vulnerability/562e81ad-7422-4437-a5b4-fcab9379db82
2022-01-25 16:51:00 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 6.1
2022-01-25 16:51:00 +00:00
cve-id : CVE-2021-24838
cwe-id : CWE-601
2022-08-10 08:17:42 +00:00
metadata :
2022-08-25 08:56:24 +00:00
verified : "true"
2022-08-27 04:41:18 +00:00
tags : redirect,anycomment,wpscan,cve,cve2021,wordpress,wp-plugin
2022-01-25 11:44:00 +00:00
requests :
- method : GET
path :
2022-08-10 08:17:42 +00:00
- "{{BaseURL}}/wp-json/anycomment/v1/auth/wordpress?redirect=https://interact.sh"
- "{{BaseURL}}/wp-json/anycomment/v1/auth/wordpress?redirect=https://interact.sh?a=https://interact.sh"
2022-01-25 11:44:00 +00:00
2022-08-10 08:17:42 +00:00
stop-at-first-match : true
2022-01-25 11:44:00 +00:00
matchers-condition : and
matchers :
- type : regex
part : header
regex :
2022-06-06 10:40:15 +00:00
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
2022-01-25 11:44:00 +00:00
- type : status
status :
- 302
