daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update ninjaform-open-redirect.yaml

patch-1
Muhammad Daffa 2022-04-18 14:04:09 +07:00 committed by GitHub
parent a42d39244f
commit fb17e3c779
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
vulnerabilities/wordpress/ninjaform-open-redirect.yaml
View File

@ -2,8 +2,8 @@ id: ninjaform-open-redirect
info: info:
name: Ninja Forms < 3.4.34 - Administrator Open Redirect name: Ninja Forms < 3.4.34 - Administrator Open Redirect
author: dhiyaneshDk author: dhiyaneshDk,daffainfo
severity: medium severity: low
description: The wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. description: The wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
reference: https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818 reference: https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818
tags: wordpress,redirect,wp-plugin,ninjaform,authenticated tags: wordpress,redirect,wp-plugin,ninjaform,authenticated
@ -18,13 +18,17 @@ requests:
Cookie: wordpress_test_cookie=WP%20Cookie%20check Cookie: wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- | - |
GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://google.com&action=nf_oauth_connect HTTP/1.1 GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://example.com&action=nf_oauth_connect HTTP/1.1
Host: {{Hostname}} Host: {{Hostname}}
req-condition: true
cookie-reuse: true cookie-reuse: true
matchers: matchers:
- type: regex - type: dsl
part: header dsl:
regex: - 'status_code_1 == 302'
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)google\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 - 'status_code_2 == 302'
- "contains(all_headers_2, 'Location: https://example.com?client_id=1')"
condition: and