OpenRedirect leads to XSS attack in login.php

[hi-unc1e]

Hi, guys

While I using testlink I had noticed that an arbitrary open redirect is not validating properly which may lead to credentials stolen of the user (self-xss).

• Risk: Medium
• Tested version: 1.9.20
• Environent: Windows10+ Chrome90.0.4430.212
• Credit：
  

Personally I prefer to split them into 2 vulns, Here's what i found

0x01 the vulnerable regex -> Unvalidated Redirects and Forward

Related code lies in login.php#371 , which is shown as follows

the regex-expression /linkto.php/ stands for the combination of [linkto]{1} + [\w]{1} + [php]{1}, in which . can be replaced by any signle character, so as a consequence.
These input could pass the validation, and reflected in the HTTP response when a user succeed in logining.

destination=ANYSITE/linkto1php

So the mediation may be like /^linkto\.php$/ , according to what your need.

What happened next may elevate this risk to a High-Level vuln.

0x02 Improper XSS validation

While deeply analysing the function of redirect(), i noticed an odd implementation.

$safeUrl = addslashes($url);

ONLY addslashes is used, which is SURELY NOT ENOUGH and VULNERABLE to XSS attack.
Which means if I craft a XSS payload in the URL, it could execute any Javascript Code in victim's browser, certainly after he's logged in.

Putting together

So the senario is:

1. Craft a URL, for example: http://testlink/login.php?viewer=123&destination=</script>linkto.php<script>alert(/xss/);//
2. Send it to a victim, the victim open that link
3. The victim logged with correct credentials
4. XSS attack is triggered, an attacker could steal the victim's valid cookie or craft a phishing page to the victim depends on different purpose.
5. Here is the PoC of this vuln ( You can see that Javascipt-script is executed on victim's browser. )
   

Mediation

For 0x01, you should validate the $destination properly according to Unvalidated_Redirects_and_Forwards_Cheat_Sheet

For 0x02, you should escape the user-input data ( htmlspecialchars() for instance ) properly, according to Cross_Site_Scripting_Prevention_Cheat_Sheet.html

[fmancardi]

master branch is not the right one
the right branch is testlink_1_9_20_fixed