Orchard 'ReturnUrl' Parameter URI - Open Redirect Detection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Open redirect vulnerability in Users/Account/LogOff in Orchard 1."""

import re
from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Scanner, Http_client):
    __info__ = {
        'name': "Orchard 'ReturnUrl' Parameter URI - Open Redirect Detection",
        'description': 'Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.',
        'author': ['KittySploit Team'],
        'severity': 'medium',
        'tags': ['web', 'scanner', 'cve', 'cve2011', 'redirect', 'orchard', 'orchardproject', 'vuln'],
        'agent': {
            'risk': 'active',
            'effects': ['network_probe'],
            'expected_requests': 1,
            'reversible': True,
            'approval_required': False,
            'produces': ['tech_hints', 'risk_signals', 'endpoints'],
            'cost': 1.0,
            'noise': 0.3,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {
                        'capability': 'admin_surface',
                        'from_detail': '',
                    },
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': ['auxiliary/scanner/http/login_page_detector'],
            },
        },
        'references': [
            'https://www.exploit-db.com/exploits/36493',
            'https://nvd.nist.gov/vuln/detail/CVE-2011-5252',
            'https://www.invicti.com/web-applications-advisories/open-redirection-vulnerability-in-orchard/',
            'https://exchange.xforce.ibmcloud.com/vulnerabilities/72110',
            'http://orchard.codeplex.com/discussions/283667',
        ],
        'cve': 'CVE-2011-5252',
    }

    def run(self):
        r = self.http_request(method="GET", path='/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fhttp://interact.sh%3f', allow_redirects=False)
        if not r or r.status_code != 200:
            return False
        headers = "\n".join(f"{k}: {v}" for k, v in r.headers.items())
        header_regexes = ('(?m)^(?:Location\\s*?:\\s*?)(?:http?://|//)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$',)
        if (any(re.search(rx, headers, 0) for rx in header_regexes)):
            self.set_info(
                severity='medium',
                reason="Orchard 'ReturnUrl' Parameter URI - Open Redirect" + " detected",
                path='/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fhttp://interact.sh%3f',
            )
            return True
        return False