tinytiny-rss-redirect: TinyTiny RSS Open Redirect

id: tinytiny-rss-redirect

info:
  name: TinyTiny RSS Open Redirect
  author: DhiyaneshDk
  severity: low
  description: |
    Detected an open redirect vulnerability in Tiny Tiny RSS where the return parameter in public.php was abused to redirect users to an attacker-controlled external URL after the authentication flow.
  reference:
    - https://seclists.org/oss-sec/2019/q1/155
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Tiny Tiny RSS"
  tags: redirect,tiny-tiny,rss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/public.php?return=http%3a%2f%2finteract.sh%2f&op=login&login=password=&profile=0"

    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

      - type: status
        status:
          - 302
          - 301
# digest: 4b0a004830460221008e7dd310bc7ace912f32a5eb2f516f14366b0fcb4aa095f660c44a7c9a4f2dc8022100b6c1aeefc0299bbe48c176368890fac6b73cdd49f6c21da114d1c78aee35aa53:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.