SickChill - Open Redirect

id: CVE-2024-53995

info:
  name: SickChill - Open Redirect
  author: omarkurt
  severity: low
  description: |
    SickChill's login endpoint's 'next_' parameter accepts arbitrary content, allowing authenticated attackers to perform open redirects, but this was fixed in commit c7128a8946c3701df95c285810eb75b2de18bf82 by redirecting to a default page.
  impact: |
    Authenticated attackers can redirect users to malicious sites, potentially leading to phishing or information disclosure.
  remediation: |
    Update to the version containing commit c7128a8946c3701df95c285810eb75b2de18bf82 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill/
    - https://vulnerabletarget.com/VT-2024-53995
    - https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33
    - https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82
    - https://github.com/SickChill/sickchill/pull/8811
    - https://nvd.nist.gov/vuln/detail/CVE-2024-53995
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
    cvss-score: 4.7
    cve-id: CVE-2024-53995
    cwe-id: CWE-601
    epss-score: 0.00951
    epss-percentile: 0.57653
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"SickChill"
  tags: cve,cve2024,redirect,sickchill

http:
  - raw:
      - |
        POST /login/?next=https://interact.sh HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
# digest: 490a00463044022000c424df4740ce6407709c14f80c0a9738b82264f725ad52678badfdb2852003022036d0cf99bce967b3c73a58ec83fb32253a9d7851fb4a03ac155c13b6d9a0c25c:922c64590222798bb761d5b6d8e72950