diff --git a/vulnerabilities/other/pollbot-redirect.yaml b/vulnerabilities/other/pollbot-redirect.yaml index b5fdae78fc..eb9be2899a 100644 --- a/vulnerabilities/other/pollbot-redirect.yaml +++ b/vulnerabilities/other/pollbot-redirect.yaml @@ -3,19 +3,21 @@ info: name: Mozilla Pollbot Services - Unauthenticated Open Redirect author: Evan Rubinstien severity: medium - description: Mozilla has a medium sevarity open redirect vulnerability in pollbot that could be used for social engineering attaks. - tags: redirect,mozilla + description: Mozilla has a medium severity open redirect vulnerability in pollbot that could be used for social engineering attaks. reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1753838 + tags: redirect,mozilla + requests: - method: GET path: - - '{{BaseURL}}/%oa/www.evil.com/' + - '{{BaseURL}}/%oa/example.com/' + matchers-condition: and matchers: - - type: word - words: - - "Location: www.evil.com" + - type: regex part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - type: status status: