The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
id: CVE-2024-0337
info:
name: Travelpayouts <= 1.1.16 - Open Redirect
author: s4e-io
severity: medium
description: |
The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
impact: |
Unauthenticated attackers can redirect users to malicious sites for phishing attacks, credential harvesting, or malware distribution by exploiting insufficient redirect validation.
remediation: |
Upgrade to the latest version of the Travelpayouts plugin that addresses this open redirect vulnerability.
reference:
- https://wpscan.com/vulnerability/2f17a274-8676-4f4e-989f-436030527890/
- https://nvd.nist.gov/vuln/detail/CVE-2024-0337
classification:
cve-id: CVE-2024-0337
epss-score: 0.00891
epss-percentile: 0.58161
metadata:
verified: true
max-request: 1
publicwww-query: inurl:"/wp-content/plugins/travelpayouts"
tags: wpscan,cve,cve2024,wp,wp-plugin,wordpress,redirect,travelpayouts,vuln
http:
- method: GET
path:
- "{{BaseURL}}/?travelpayouts_redirect=https://oast.me"
redirects: true
max-redirects: 2
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'
# digest: 4a0a0047304502207f7f459a18adad42b89ec7f8c154bf41ffb1247a031f46553a75d08c62f64d5e022100b91693d1746d27b84e2ccec56bc5d8892a393e3f07abde918a4e0389d3f00bc7:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.