CVE-2020-36664 (published 2023-03-04T17:15Z)

A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222232.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/artesaos/seotools
commit_details: repo_url: https://github.com/artesaos/seotools
author: Ugur Aydogdu
author_date: 2020-04-02 22:53:38+03:00
msg: open redirect vulnerability fixes (#201)

* open redirect vulnerability fix for opengraph

* open redirect vulnerability fix for twitter cards

* open redirect vulnerability fix for setTitle

* fixed preg replace

* Update OpenGraph.php

* Update TwitterCards.php
repository: repo_url: https://github.com/artesaos/seotools
repo_name: artesaos/seotools
description: SEO Tools for Laravel
repo_language: PHP
owner: artesaos
file_changes: filename: OpenGraph.php
change_type: ModificationType.MODIFY
diff: @@ -258,6 +258,7 @@ class OpenGraph implements OpenGraphContract
      */
     protected function makeTag($key = null, $value = null, $ogPrefix = false)
     {
+        $value = str_replace(['http-equiv=', 'url='], '', $value);
         return sprintf(
             '<meta property="%s%s" content="%s" />%s',
             $ogPrefix ? $this->og_prefix : '',

programming_language: PHP
filename: SEOMeta.php
change_type: ModificationType.MODIFY
diff: @@ -213,6 +213,9 @@ class SEOMeta implements MetaTagsContract
      */
     public function setTitle($title, $appendDefault = true)
     {
+        // open redirect vulnerability fix
+        $title = str_replace(['http-equiv=', 'url='], '', $title);
+        
         // clean title
         $title = strip_tags($title);
 

programming_language: PHP
filename: TwitterCards.php
change_type: ModificationType.MODIFY
diff: @@ -83,6 +83,7 @@ class TwitterCards implements TwitterCardsContract
      */
     private function makeTag($key, $value)
     {
+        $value = str_replace(['http-equiv=', 'url='], '', $value);
         return '<meta name="'.$this->prefix.strip_tags($key).'" content="'.strip_tags($value).'" />';
     }
 

programming_language: PHP