Is CVE-2017-5474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5474 being exploited in the wild.

How severe is CVE-2017-5474?

Medium severity, with a CVSS score of 6.1, published 14 January 2017.

Is there a fix for CVE-2017-5474?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-5474 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2017-5474?

Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5474: Serendipity open redirect in comment.php

CVE-2017-5474 · Severity: medium · CVSS 6.1 · Published 2017-01-14

Serendipity, a popular open-source PHP blogging engine, contains a security flaw that allows attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can send them to a fraudulent site that looks legitimate, increasing the success of phishing attacks and potentially leading to credential theft. This issue affects the comment management component of the software.

Technologies: Serendipity. Vendors: Serendipity.

Quick answers

Is CVE-2017-5474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5474 being exploited in the wild.
How severe is CVE-2017-5474?: Medium severity, with a CVSS score of 6.1, published 14 January 2017.
Which products and versions are affected?: Serendipity Through 2.0.5.
Is there a fix for CVE-2017-5474?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-5474 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2017-5474?: Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in 'comment.php' within Serendipity versions up to and including 2.0.5. The application fails to properly validate the 'HTTP_REFERER' header before using it in a 302 redirect location. A remote attacker can exploit this by inducing a user to visit a crafted URL that triggers a redirect to an external, untrusted domain. This is primarily used to facilitate phishing campaigns or bypass security filters that trust the original domain. The fix involves implementing a check to ensure the referrer matches the 'HTTP_HOST' of the blog.

Affected products

s9y Serendipity Through 2.0.5

Timeline

2017-01-14: disclosed
2017-01-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.