lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 02 Mar 2019 12:59:46 +0100
From: Jan Kopriva <>
Subject: [FD] Open Redirection vulnerability in Babel (CMSMS Module)

Affected Software: Babel: Multilingual Site module for CMS Made Simple
Affected Version: 0.4.1 and earlier
Patched Version: None - project is no longer under development
CVE Identifier: TBD
Vulnerability type: CWE-601: URL Redirection to Untrusted Site ('Open 
Severity Rating: CVSS v3 Base Score: 6.1 
Security Researcher: Jan Kopriva @ Alef Nula

The Babel multi-language module for CMSMS contains an open redirection 
vulnerability in a script within the redirect.php file. The script takes 
an argument specifying a URL to which a browser should be redirected. 
This URL may be completely arbitrary. It is therefore possible to craft 
a link to a Babel-enabled site which causes redirection to any URL 
specified, even outside the originating domain. This is especially 
useful for phishing attacks, when attacker creates a link to a safe 
site, which, without the knowledge of a user, redirects him or her to a 
fake/malicious site. All CMSMS sites with Babel module installed are 
affected, since redirect.php is always publically accessible.

Detailed description:
The Babel module ( provides 
CMSMS sites with the capacity to easily switch between multiple 
translations of web page content. Desired translation may be chosen by 
sending a GET request to 
Under normal conditions, this PHP script takes two arguments - "newlang" 
and "newurl". The first argument sets the desired language for the 
translation and the second one sets URL which should be displayed in 
selected language.
A non-working example of what the URL might look like is
The vulnerability is caused by the absence of any filtering when the 
parameter "newurl" is processed (the parametr "newlang" is - for our 
purposes - optional and may be omitted).
Further information regarding the vulnerability may be found at:

Proof of Concept:

Removal of the Babel module from any affected site.

Disclosure timeline:
Developer Contacted: 2. 2. 2019
Developer Responded: 11. 2. 2019 (project abandoned, no new versions are 
to be expected)
Disclosure to CSIRT network: 14. 2. 2019
Public Disclosure: 23. 2. 2019

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists