diff --git a/kentico-open-redirect.yaml b/kentico-open-redirect.yaml new file mode 100644 index 0000000000..c4c9decbc0 --- /dev/null +++ b/kentico-open-redirect.yaml @@ -0,0 +1,20 @@ +id: kentico-open-redirect + +info: + name: Web application Kentico CMS 8.2 Open Redirection + author: 0x_Akoko + description: The GetDocLink.ashx with link variable is vulnerable to open redirect vulnerability + reference: https://packetstormsecurity.com/files/133981/Kentico-CMS-8.2-Cross-Site-Scripting-Open-Redirect.html + severity: low + tags: kentico,redirect + +requests: + - method: GET + path: + - "{{BaseURL}}/CMSPages/GetDocLink.ashx?link=https://example.com/" + + matchers: + - type: regex + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$' + part: header