id: CVE-2023-29204

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or malware downloads.
  remediation: |
    Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
    - https://jira.xwiki.org/browse/XWIKI-10309
    - https://jira.xwiki.org/browse/XWIKI-19994
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29204
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29204
    cwe-id: CWE-601
    epss-score: 0.00094
    epss-percentile: 0.39237
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2023,xwiki,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//www.oast.me"
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=http:/www.oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 4a0a00473045022100a9e6f163f3f39c2b3b46524179d1705705a4934c4208c88d28b483f3b91dd690022040db666a1484eebbadd5cc2370e5b3d165703d7a1c2162ccc48f8d2a9fcda3dd:922c64590222798bb761d5b6d8e72950