id: homeautomation-v3-openredirect

info:
  name: HomeAutomation v3.3.2 Open Redirect
  author: 0x_Akoko
  severity: medium
  description: A vulnerability in the HomeAutomation product allows remote unauthenticated attackers to inject a redirect URL via the 'api.php' endpoint and the 'redirect' parameter.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5559.php
  tags: iot,redirect

requests:
  - method: GET
    path:
      - "{{BaseURL}}/homeautomation_v3_3_2/api.php?do=groups/toggle&groupid=1&status=1&redirect=https://example.com/"

    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)example\.com.*$'
        part: header