.. / CVE-2023-24044

• Open Redirect
• Nuclei
• Web

Exploit for Plesk Obsidian <=18.0.49 - Open Redirect (CVE-2023-24044)

Description:

Plesk Obsidian through 18.0.49 contains an open redirect vulnerability via the login page. An attacker can redirect users to malicious websites via a host request header and thereby access user credentials and execute unauthorized operations. NOTE: The vendor’s position is “the ability to use arbitrary domain names to access the panel is an intended feature.”

Nuclei Template

View the template here CVE-2023-24044.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-24044.yaml

References: