CVE-2021-3654: noVNC Open Redirect

id: CVE-2021-3654

info:
  name: noVNC Open Redirect
  author: txf
  severity: medium
  description: |-
    A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
  reference:
    - https://www.tenable.com/security/research/tra-2021-35
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3654
  tags: cve,cve2021,novnc,redirect
  created: 2023/06/23

rules:
  r0:
    request:
      method: GET
      path: "/"
    expression: |
      response.status == 200 && response.body.bcontains(b"<title>noVNC</title>")
  r1:
    request:
      method: GET
      path: "//baidu.com/%2f.."
    expression: |
      response.status == 301 && response.headers["location"] == "//baidu.com/%2f../"
expression: r0() && r1()