Simplified open redirect

artemis/config.py

@@ -482,6 +482,8 @@ class Nuclei:
                         "javascript/default-logins/ssh-default-logins.yaml",
                         # Mostly Moodle config
                         "http/exposures/configs/behat-config.yaml",
+                        # Catches multiple open redirects
+                        "http/cves/2018/CVE-2018-11784.yaml",
                     ]
                 ),
                 cast=decouple.Csv(str),
@@ -536,8 +538,6 @@ class Nuclei:
                         "custom:xss-inside-tag-top-params",
                         "http/miscellaneous/defaced-website-detect.yaml",
                         "http/misconfiguration/google/insecure-firebase-database.yaml",
-                        # This catches other Open Redirects as well
-                        "http/cves/2018/CVE-2018-11784.yaml",
                         # Until https://github.com/projectdiscovery/nuclei-templates/issues/8657
                         # gets fixed, these templates return a FP on phpinfo(). Let's not spam
                         # our recipients with FPs.

artemis/modules/data/nuclei_templates_custom/open-redirect-simplified.yaml

@@ -0,0 +1,41 @@
+id: open-redirect-simplified
+
+info:
+  name: Open Redirect - Simplified Detection
+  author: kazet
+  severity: medium
+  description: An open redirect vulnerability was detected. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cwe-id: CWE-601
+  tags: redirect,generic
+
+http:
+  - method: GET
+    path:
+      - "{{RootURL}}/{{redirect}}"
+
+    payloads:
+      redirect:
+        - '.example.com'
+        - 'example.com/'
+        - 'example.com'
+        - '/example.com/'
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: header
+        regex:
+          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)example\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
+
+      - type: status
+        status:
+          - 301
+          - 302
+          - 307
+          - 308
+        condition: or