diff --git a/artemis/config.py b/artemis/config.py index 46688493d..d0ff19a96 100644 --- a/artemis/config.py +++ b/artemis/config.py @@ -482,6 +482,8 @@ class Nuclei: "javascript/default-logins/ssh-default-logins.yaml", # Mostly Moodle config "http/exposures/configs/behat-config.yaml", + # Catches multiple open redirects + "http/cves/2018/CVE-2018-11784.yaml", ] ), cast=decouple.Csv(str), @@ -536,8 +538,6 @@ class Nuclei: "custom:xss-inside-tag-top-params", "http/miscellaneous/defaced-website-detect.yaml", "http/misconfiguration/google/insecure-firebase-database.yaml", - # This catches other Open Redirects as well - "http/cves/2018/CVE-2018-11784.yaml", # Until https://github.com/projectdiscovery/nuclei-templates/issues/8657 # gets fixed, these templates return a FP on phpinfo(). Let's not spam # our recipients with FPs. diff --git a/artemis/modules/data/nuclei_templates_custom/open-redirect-simplified.yaml b/artemis/modules/data/nuclei_templates_custom/open-redirect-simplified.yaml new file mode 100644 index 000000000..f057198c6 --- /dev/null +++ b/artemis/modules/data/nuclei_templates_custom/open-redirect-simplified.yaml @@ -0,0 +1,41 @@ +id: open-redirect-simplified + +info: + name: Open Redirect - Simplified Detection + author: kazet + severity: medium + description: An open redirect vulnerability was detected. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N + cvss-score: 6.1 + cwe-id: CWE-601 + tags: redirect,generic + +http: + - method: GET + path: + - "{{RootURL}}/{{redirect}}" + + payloads: + redirect: + - '.example.com' + - 'example.com/' + - 'example.com' + - '/example.com/' + + stop-at-first-match: true + + matchers-condition: and + matchers: + - type: regex + part: header + regex: + - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1 + + - type: status + status: + - 301 + - 302 + - 307 + - 308 + condition: or