Executive Summary

CVE-2020-36912 is an open redirect vulnerability in Plexus anblick Digital Signage Management version 3.1.13. It occurs in the 'PantallaLogin' script where the 'pagina' GET parameter is not properly validated. Attackers can manipulate this parameter to create malicious links that redirect users from a trusted site to arbitrary, potentially harmful external websites. This can be exploited to perform phishing or spoofing attacks by tricking users into visiting untrusted sites. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by enabling attackers to redirect users to malicious websites through crafted links. This can lead to phishing attacks, where users might be tricked into providing sensitive information or downloading malware. Since the redirect happens from a trusted domain, users may be more likely to trust the malicious destination, increasing the risk of security breaches. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the 'PantallaLogin' script and inspecting the 'pagina' GET parameter for suspicious or unexpected URL redirection values. You can use network traffic analysis tools like tcpdump or Wireshark to capture HTTP requests and grep or filter for 'PantallaLogin' and 'pagina' parameters. For example, using curl to test the endpoint with crafted 'pagina' parameters to see if redirection occurs: curl -v 'http://<target>/PantallaLogin?pagina=http://malicious.example.com'. Additionally, web server logs can be searched for unusual 'pagina' parameter values that redirect to external sites. [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or validating the 'pagina' GET parameter input to ensure it only allows internal or trusted URLs, implementing input validation or sanitization on the server side, and educating users to be cautious about clicking suspicious links. Since no vendor patch or status is provided, consider applying web application firewall (WAF) rules to block or monitor requests with suspicious 'pagina' parameter values. Also, monitor and audit logs for exploitation attempts and inform users about the risk of phishing via malicious redirects. [1, 3]

Useful 0 Not Useful 0