id: wp-upward-theme-redirect

info:
  name: WordPress Upward Themes <1.5 - Open Redirect
  author: r3Y3r53
  severity: medium
  description: |
    WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
  reference:
    - https://cxsecurity.com/issue/WLB-2020030133
  metadata:
    verified: true
    max-request: 1
    google-query: inurl:"/wp-content/themes/Upward/"
  tags: wordpress,wp-theme,wp,upward,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/Upward/go.php?https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
# digest: 4a0a00473045022100fa3506b7163f77d9c92e052257028e5e2aacda1c23895b192b6b200004be862302205acd138fb33b68e1247392a6906c6b09c6006927d2487ddac7873b69e434291f:922c64590222798bb761d5b6d8e72950