CVE-2020-23015 PoC — Deciso OPNsense 输入验证错误漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23015.yaml

Associated Vulnerability

Title:Deciso OPNsense 输入验证错误漏洞 (CVE-2020-23015)
Description:Deciso OPNsense是荷兰Deciso公司的一套基于FreeBSD的开源防火墙和路由软件。 OPNsense 20.1.5版本及之前版本存在安全漏洞，该漏洞源于发现一个开放重定向问题。登录页面的重定向参数“url”没有被过滤。

Description

OPNsense through 20.1.5 contains an open redirect vulnerability via the url redirect parameter in the login page, which is not filtered. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

File Snapshot


 id: CVE-2020-23015

info:
  name: OPNsense <=20.1.5 - Open Redirect
  author: 0x_Akoko
  severity: m

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!