id: wp-upward-theme-redirect

info:
  name: WordPress Upward Themes <1.5 - Open Redirect
  author: r3Y3r53
  severity: medium
  description: |
    WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
  reference:
    - https://cxsecurity.com/issue/WLB-2020030133
  metadata:
    verified: true
    max-request: 1
    google-query: inurl:"/wp-content/themes/Upward/"
  tags: wordpress,wp-theme,wp,upward,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/Upward/go.php?https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

# digest: 4b0a00483046022100959ad363ce68e1b90e64056046f0d8d8b45642ad537e374d6634c889a95f9be3022100d55f7bd232a5902c312f66c1f991f5213ef13181f1ca22709b3588bcb29accc2:922c64590222798bb761d5b6d8e72950
