ILIAS eLearning <7.16 - Open Redirect

2022-12-1010:38:15

ProjectDiscovery

github.com

cve

cve2022

open

redirect

ilias

packetstorm

seclists

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.8%

JSON

ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

id: CVE-2022-45917

info:
  name: ILIAS eLearning <7.16 - Open Redirect
  author: arafatansari
  severity: medium
  description: |
    ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.
  remediation: |
    Upgrade to ILIAS eLearning version 7.16 or later to fix the open redirect vulnerability.
  reference:
    - https://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html
    - https://seclists.org/fulldisclosure/2022/Dec/7
    - https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
    - https://github.com/advisories/GHSA-hf6q-rx44-fh6j
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45917
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-45917
    cwe-id: CWE-601
    epss-score: 0.00221
    epss-percentile: 0.60187
    cpe: cpe:2.3:a:ilias:ilias:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: ilias
    product: ilias
    shodan-query:
      - http.html:"ILIAS"
      - http.html:"ilias"
    fofa-query: body="ilias"
  tags: cve,cve2022,redirect,packetstorm,seclists,ilias,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/shib_logout.php?action=logout&return=https://oast.me"
      - "{{BaseURL}}/ilias/shib_logout.php?action=logout&return=https://oast.me"

    stop-at-first-match: true
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$'
# digest: 4a0a0047304502202a215ae170ee447f12127bcd88694cfa9a3efe06dfc4c838ee414b72af534b48022100f9d28d9da61de82fea8e1af3990ccfa2f51592237164217c9c7810f1d4890adb:922c64590222798bb761d5b6d8e72950