CVE-2020-36664: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222232.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-03-04T17:15Z
Repository: https://github.com/artesaos/seotools
Language: PHP
Files changed: src/SEOTools/OpenGraph.php, src/SEOTools/SEOMeta.php, src/SEOTools/TwitterCards.php
Commit date: 2020-04-02 16:53:38 -0300
Commit message: open redirect vulnerability fixes (#201)

* open redirect vulnerability fix for opengraph

* open redirect vulnerability fix for twitter cards

* open redirect vulnerability fix for setTitle

* fixed preg replace

* Update OpenGraph.php

* Update TwitterCards.php
Diff: diff --git a/src/SEOTools/OpenGraph.php b/src/SEOTools/OpenGraph.php
index 7190140..983154e 100644
--- a/src/SEOTools/OpenGraph.php
+++ b/src/SEOTools/OpenGraph.php
@@ -256,10 +256,11 @@ class OpenGraph implements OpenGraphContract
      *
      * @return string
      */
     protected function makeTag($key = null, $value = null, $ogPrefix = false)
     {
+        $value = str_replace(['http-equiv=', 'url='], '', $value);
         return sprintf(
             '<meta property="%s%s" content="%s" />%s',
             $ogPrefix ? $this->og_prefix : '',
             strip_tags($key),
             strip_tags($value),
diff --git a/src/SEOTools/SEOMeta.php b/src/SEOTools/SEOMeta.php
index 8b63b77..4de6164 100644
--- a/src/SEOTools/SEOMeta.php
+++ b/src/SEOTools/SEOMeta.php
@@ -211,10 +211,13 @@ class SEOMeta implements MetaTagsContract
     /**
      * {@inheritdoc}
      */
     public function setTitle($title, $appendDefault = true)
     {
+        // open redirect vulnerability fix
+        $title = str_replace(['http-equiv=', 'url='], '', $title);
+        
         // clean title
         $title = strip_tags($title);
 
         // store title session
         $this->title_session = $title;
diff --git a/src/SEOTools/TwitterCards.php b/src/SEOTools/TwitterCards.php
index bbce2bb..0550509 100644
--- a/src/SEOTools/TwitterCards.php
+++ b/src/SEOTools/TwitterCards.php
@@ -81,10 +81,11 @@ class TwitterCards implements TwitterCardsContract
      *
      * @internal param string $values
      */
     private function makeTag($key, $value)
     {
+        $value = str_replace(['http-equiv=', 'url='], '', $value);
         return '<meta name="'.$this->prefix.strip_tags($key).'" content="'.strip_tags($value).'" />';
     }
 
     /**
      * {@inheritdoc}

Fixed code:         $value = str_replace(['http-equiv=', 'url='], '', $value);
        // open redirect vulnerability fix
        $title = str_replace(['http-equiv=', 'url='], '', $title);
        
        $value = str_replace(['http-equiv=', 'url='], '', $value);