odoo-login-redirect: Reflected Odoo - Open Redirect

id: odoo-login-redirect

info:
  name: Reflected Odoo - Open Redirect
  author: DhiyaneshDk
  severity: low
  description: |
    Detected an open redirect vulnerability in Odoo where the redirect parameter in web/login was abused to redirect users to an attacker-controlled external URL after the authentication flow.
  reference:
    - https://github.com/odoo/odoo/issues/13812
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.component:"Odoo" html:"web/login"
  tags: redirect,odoo,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/login?db=asdf&redirect=http://interact.sh"

    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
        part: header
# digest: 4a0a00473045022041e4cbc50785fc0254af5b3914404d10e1d4d69c4176a60d5b76d64fc409f82b022100ad7b16759d427025629830eed2affb20d77dd0211a7ce3cd615417b2e460edb2:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.