CVE-2020-36663: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The patch is named ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222231.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-03-04T07:15Z
Repository: https://github.com/artesaos/seotools
Language: PHP
Files changed: src/SEOTools/OpenGraph.php, src/SEOTools/SEOMeta.php, src/SEOTools/TwitterCards.php
Commit date: 2020-04-02 16:53:38 -0300
Commit message: open redirect vulnerability fixes (#201)

* open redirect vulnerability fix for opengraph

* open redirect vulnerability fix for twitter cards

* open redirect vulnerability fix for setTitle

* fixed preg replace

* Update OpenGraph.php

* Update TwitterCards.php
Diff: diff --git a/src/SEOTools/OpenGraph.php b/src/SEOTools/OpenGraph.php
index 7190140..983154e 100644
--- a/src/SEOTools/OpenGraph.php
+++ b/src/SEOTools/OpenGraph.php
@@ -256,10 +256,11 @@ class OpenGraph implements OpenGraphContract
      *
      * @return string
      */
     protected function makeTag($key = null, $value = null, $ogPrefix = false)
     {
+        $value = str_replace(['http-equiv=', 'url='], '', $value);
         return sprintf(
             '<meta property="%s%s" content="%s" />%s',
             $ogPrefix ? $this->og_prefix : '',
             strip_tags($key),
             strip_tags($value),
diff --git a/src/SEOTools/SEOMeta.php b/src/SEOTools/SEOMeta.php
index 8b63b77..4de6164 100644
--- a/src/SEOTools/SEOMeta.php
+++ b/src/SEOTools/SEOMeta.php
@@ -211,10 +211,13 @@ class SEOMeta implements MetaTagsContract
     /**
      * {@inheritdoc}
      */
     public function setTitle($title, $appendDefault = true)
     {
+        // open redirect vulnerability fix
+        $title = str_replace(['http-equiv=', 'url='], '', $title);
+        
         // clean title
         $title = strip_tags($title);
 
         // store title session
         $this->title_session = $title;
diff --git a/src/SEOTools/TwitterCards.php b/src/SEOTools/TwitterCards.php
index bbce2bb..0550509 100644
--- a/src/SEOTools/TwitterCards.php
+++ b/src/SEOTools/TwitterCards.php
@@ -81,10 +81,11 @@ class TwitterCards implements TwitterCardsContract
      *
      * @internal param string $values
      */
     private function makeTag($key, $value)
     {
+        $value = str_replace(['http-equiv=', 'url='], '', $value);
         return '<meta name="'.$this->prefix.strip_tags($key).'" content="'.strip_tags($value).'" />';
     }
 
     /**
      * {@inheritdoc}

Fixed code:         $value = str_replace(['http-equiv=', 'url='], '', $value);
        // open redirect vulnerability fix
        $title = str_replace(['http-equiv=', 'url='], '', $title);
        
        $value = str_replace(['http-equiv=', 'url='], '', $value);