From 72fcdc20bf491424b0f59266d7ef7853519a9175 Mon Sep 17 00:00:00 2001
From: PikPikcU <60111811+pikpikcu@users.noreply.github.com>
Date: Wed, 28 Jul 2021 08:37:25 +0700
Subject: [PATCH 1/3] Create bitrix-open-redirect.yaml

---
 .../other/bitrix-open-redirect.yaml           | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 vulnerabilities/other/bitrix-open-redirect.yaml

diff --git a/vulnerabilities/other/bitrix-open-redirect.yaml b/vulnerabilities/other/bitrix-open-redirect.yaml
new file mode 100644
index 0000000000..3e12be30af
--- /dev/null
+++ b/vulnerabilities/other/bitrix-open-redirect.yaml
@@ -0,0 +1,31 @@
+id: bitrix-open-redirect
+
+info:
+  name: Bitrix Open URL redirect detection
+  author: pikpikcu
+  severity: low
+  tags: redirect,bitrix
+
+requests:
+  - method: GET
+
+    path:
+      - '{{BaseURL}}/bitrix/rk.php?goto=https://example.com'
+      - '{{BaseURL}}/bitrix/redirect.php?event1=&event2=&event3=&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/redirect.php?event3=352513&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/redirect.php?event1=demo_out&event2=sm_demo&event3=pdemo&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/redirect.php?site_id=s1&event1=select_product_t1&event2=contributions&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/redirect.php?event1=&event2=&event3=download&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/rk.php?id=28&site_id=s2&event1=banner&event2=click&event3=3+%2F+%5B28%5D+%5BBANNER_AREA_FOOTER2%5D+%D0%9F%D0%BE%D1%81%D0%B5%D1%82%D0%B8%D1%82%D0%B5+%D0%B2%D0%B2%D0%BE%D0%B4%D0%BD%D1%83%D1%8E+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E+%D0%BB%D0%B5%D0%BA%D1%86%D0%B8%D1%8E+APTOS&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/rk.php?id=84&site_id=n1&event1=banner&event2=click&event3=1+%2F+%5B84%5D+%5BMOBILE_HOME%5D+Love+Card&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/rk.php?id=691&site_id=s3&event1=banner&event2=click&event3=1+%2F+%5B691%5D+%5BNEW_INDEX_BANNERS%5D+Trade-in+football&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/rk.php?id=129&event1=banner&event2=click&event3=5+%2F+%5B129%5D+%5BGARMIN_AKCII%5D+Garmin+%E1%EE%ED%F3%F1+%ED%EE%E2%EE%F1%F2%FC+%E2+%E0%EA%F6%E8%E8&goto=https://example.com'
+      - '{{BaseURL}}bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://example.com'
+      - '{{BaseURL}}/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://example.com'
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
+        part: header

From 783550d00383cb05a927f11199b3515962c10539 Mon Sep 17 00:00:00 2001
From: PikPikcU <60111811+pikpikcu@users.noreply.github.com>
Date: Wed, 28 Jul 2021 08:38:48 +0700
Subject: [PATCH 2/3] Update bitrix-open-redirect.yaml

---
 vulnerabilities/other/bitrix-open-redirect.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/vulnerabilities/other/bitrix-open-redirect.yaml b/vulnerabilities/other/bitrix-open-redirect.yaml
index 3e12be30af..e88df0c69b 100644
--- a/vulnerabilities/other/bitrix-open-redirect.yaml
+++ b/vulnerabilities/other/bitrix-open-redirect.yaml
@@ -4,6 +4,7 @@ info:
   name: Bitrix Open URL redirect detection
   author: pikpikcu
   severity: low
+  reference: https://packetstormsecurity.com/files/151955/1C-Bitrix-Site-Management-Russia-2.0-Open-Redirection.html
   tags: redirect,bitrix
 
 requests:

From 49efd9fa07ea230a8670ab05abd40ffddc501ce3 Mon Sep 17 00:00:00 2001
From: Prince Chaddha <cyberbossprince@gmail.com>
Date: Thu, 29 Jul 2021 00:13:15 +0530
Subject: [PATCH 3/3] Update bitrix-open-redirect.yaml

---
 vulnerabilities/other/bitrix-open-redirect.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/vulnerabilities/other/bitrix-open-redirect.yaml b/vulnerabilities/other/bitrix-open-redirect.yaml
index e88df0c69b..ebe3db78d6 100644
--- a/vulnerabilities/other/bitrix-open-redirect.yaml
+++ b/vulnerabilities/other/bitrix-open-redirect.yaml
@@ -30,3 +30,9 @@ requests:
         regex:
           - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
         part: header
+
+      - type: status
+        status:
+          - 302
+          - 301
+        condition: or