Merge pull request #3747 from Akokonunes/patch-120

Create otobo-open-redirect.yaml

vulnerabilities/other/otobo-open-redirect.yaml

@@ -0,0 +1,22 @@
+id: otobo-open-redirect
+
+info:
+  name: Open Redirect in Otobo
+  author: 0x_Akoko
+  severity: medium
+  description: There is a open redirect vulnerability in Otobo
+  reference:
+    - https://huntr.dev/bounties/de64ac71-9d06-47cb-b643-891db02f2a1f/
+    - https://github.com/rotheross/otobo
+  tags: redirect,otobo
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/otobo/index.pl?Action=ExternalURLJump;URL=http://www.example.com'
+
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1