Merge pull request #4180 from daffainfo/patch-17

Update ninjaform-open-redirect.yaml

vulnerabilities/wordpress/ninjaform-open-redirect.yaml

@@ -2,11 +2,11 @@ id: ninjaform-open-redirect
 
 info:
   name: Ninja Forms < 3.4.34 - Administrator Open Redirect
-  author: dhiyaneshDk
-  severity: medium
+  author: dhiyaneshDk,daffainfo
+  severity: low
   description: The wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
   reference: https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818
-  tags: wordpress,redirect,wp-plugin,ninjaform,authenticated
+  tags: wordpress,redirect,wp-plugin,ninjaform,authenticated,wp
 
 requests:
   - raw:
@@ -18,13 +18,17 @@ requests:
         Cookie: wordpress_test_cookie=WP%20Cookie%20check
 
         log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
+
       - |
-        GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://google.com&action=nf_oauth_connect HTTP/1.1
+        GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://example.com&action=nf_oauth_connect HTTP/1.1
         Host: {{Hostname}}
 
+    req-condition: true
     cookie-reuse: true
     matchers:
-      - type: regex
-        part: header
-        regex:
-          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)google\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+      - type: dsl
+        dsl:
+          - 'status_code_1 == 302'
+          - 'status_code_2 == 302'
+          - "contains(all_headers_2, 'Location: https://example.com?client_id=1')"
+        condition: and