XWiki - Open Redirect

id: CVE-2023-29204

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or malware downloads.
  remediation: |
    Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
    - https://jira.xwiki.org/browse/XWIKI-10309
    - https://jira.xwiki.org/browse/XWIKI-19994
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29204
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29204
    cwe-id: CWE-601
    epss-score: 0.01756
    epss-percentile: 0.75237
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2023,xwiki,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//www.oast.me"
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=http:/www.oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 4b0a00483046022100bed5e9b8b7d2b92618c2637c01013dfca5db775b78b025da0399a56f122afdc9022100db9afeb8dfec1cc46558fdc58f6bd0448989bef4ed542963b4c385962da7c8f3:922c64590222798bb761d5b6d8e72950