CVE-2023-24735

Executive Summary

CVE-2023-24735 is an open redirect vulnerability identified in PMB (PhpMyBibli) version 7.4.6, a popular open-source library management system. The flaw resides in the /opac_css/pmb.php component, allowing an unauthenticated attacker to craft a URL that redirects a victim to an arbitrary external domain. This can be leveraged for phishing attacks, credential harvesting, or malware distribution. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), with a public proof-of-concept (PoC) available via a Nuclei template. No official patch has been released as of the latest analysis, and the EPSS score is 0.07119%, indicating low exploitation activity but significant potential for targeted attacks.

Supply Chain & Package Security

This vulnerability affects the PMB application, which is distributed as a PHP-based web application. While not a package manager ecosystem (NPM, PyPI, Go, Ruby), the risk extends to any organization using PMB for library management. The lack of a patch means users must rely on manual mitigations, such as input validation or web application firewall (WAF) rules, to protect against exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must click the crafted link.
• Scope: Changed (S:C) – Redirect impacts a different security scope (external domain).
• Confidentiality Impact: Low (C:L) – Potential for information disclosure via phishing.
• Integrity Impact: Low (I:L) – Possible modification of user data through redirection.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. The vulnerability requires user interaction but can be chained with social engineering to achieve significant impact, such as credential theft or malware installation.

Deep Dive & Mechanics

The vulnerability exists in the pmb.php script located in the /opac_css/ directory. The script accepts a url parameter and, after validating a hash (likely an MD5 hash of the URL), performs a redirect using the Location header. The flaw is that the validation is insufficient—the hash check can be bypassed or the redirect is performed without proper domain whitelisting, allowing an attacker to specify any external domain.

The Nuclei template reveals the exploitation mechanism:

• The attacker sends a GET request to /pmb/opac_css/pmb.php?url=https://oast.me&hash=<md5_of_url>.
• The server responds with a Location header pointing to the attacker-controlled domain (e.g., https://oast.me).
• The matcher in the template uses a regex to confirm the redirect target contains the attacker's domain.

The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site), which is a common web application flaw. The lack of a patch suggests the vendor may have discontinued support or not addressed the issue.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 7.4.6): The vulnerable code in /opac_css/pmb.php likely performs a redirect without validating the target domain against a whitelist. A simplified example:

<?php
$url = $_GET['url'];
$hash = $_GET['hash'];
if (md5($url) === $hash) {
    header("Location: $url");
    exit;
}
?>

This allows any URL to be used as long as the hash matches, which an attacker can compute.

Patched Code (Hypothetical): A patched version would validate the URL against a whitelist of allowed domains or use a relative path:

<?php
$allowed_domains = ['example.com', 'pmb.local'];
$url = $_GET['url'];
$parsed_url = parse_url($url);
if (in_array($parsed_url['host'], $allowed_domains)) {
    header("Location: $url");
    exit;
} else {
    // Log or deny
    http_response_code(400);
    echo "Invalid redirect target.";
}
?>

Since no official patch exists, users must implement such validation manually.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running PMB 7.4.6 (e.g., via Shodan dork http.favicon.hash:1469328760).
2. Craft a malicious URL:

   http://target.com/pmb/opac_css/pmb.php?url=https://attacker.com&hash=<md5_of_attacker_url>
   

3. Send the link to a victim via email, social media, or other channels.
4. When the victim clicks, they are redirected to https://attacker.com, which could host a phishing page or malware.

Lab Setup:

• Use a local PMB 7.4.6 installation (e.g., via Docker or manual setup).
• Run the Nuclei template to verify the vulnerability:

  nuclei -u http://localhost/pmb -t CVE-2023-24735.yaml
  

• Alternatively, use curl:

  curl -v "http://localhost/pmb/opac_css/pmb.php?url=https://oast.me&hash=$(echo -n 'https://oast.me' | md5sum | cut -d' ' -f1)"
  

Blue Team

Detection Steps:

• Monitor web server logs for requests to /opac_css/pmb.php with a url parameter pointing to external domains.
• Use the provided YARA and Sigma rules to detect exploitation attempts.
• Implement a WAF rule to block requests where the url parameter does not match an allowed domain list.

Mitigation:

• Apply input validation to the url parameter, allowing only relative paths or whitelisted domains.
• Disable the vulnerable script if not needed.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• URL Pattern: */opac_css/pmb.php?url=*&hash=*
• HTTP Response Header: Location: https://<external-domain>
• Shodan Query: http.favicon.hash:1469328760 or http.html:"pmb group"
• Fofa Query: body="pmb group" or icon_hash=1469328760
• Example Malicious Request:

  GET /pmb/opac_css/pmb.php?url=https://evil.com&hash=5d41402abc4b2a76b9719d911017c592 HTTP/1.1
  Host: target.com
  

Detection Engineering

YARA Rule

rule CVE_2023_24735_Open_Redirect {
    meta:
        description = "Detects exploitation attempts for CVE-2023-24735 in PMB"
        author = "Valters IT"
        date = "2025-04-08"
        cve = "CVE-2023-24735"
    strings:
        $url_param = "url="
        $hash_param = "&hash="
        $pmb_script = "/opac_css/pmb.php"
    condition:
        $pmb_script and $url_param and $hash_param
}

Sigma Rule

title: CVE-2023-24735 PMB Open Redirect Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the PMB open redirect vulnerability
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/opac_css/pmb.php'
        cs-uri-query|contains: 'url='
    condition: selection
falsepositives:
    - Legitimate use of the redirect feature (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24735 PMB Open Redirect Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/opac_css/pmb.php"; http_uri; content:"url="; http_uri; pcre:"/url=https?:\/\/[^&]+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2023-24735

info:
  name: PMB 7.4.6 - Open Redirect
  author: r3Y3r53
  severity: medium
  description: |
    PMB v7.4.6 contains an open redirect vulnerability via the component /opac_css/pmb.php. An attacker can redirect a user to an external domain via a crafted URL and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.
  remediation: |
    Upgrade PMB to a version that has addressed the open redirect vulnerability (CVE-2023-24735).
  reference:
    - https://github.com/AetherBlack/CVE/blob/main/PMB/readme.md
    - https://github.com/AetherBlack/CVE/tree/main/PMB
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24735
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-24735
    cwe-id: CWE-601
    epss-score: 0.07119
    epss-percentile: 0.91566
    cpe: cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sigb
    product: pmb
    shodan-query:
      - http.favicon.hash:1469328760
      - http.html:"pmb group"
    fofa-query:
      - body="pmb group"
      - icon_hash=1469328760
  tags: cve2023,cve,redirect,pmb,pmb_project,sigb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pmb/opac_css/pmb.php?url=https://oast.me&hash={{md5('https://oast.me')}}"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me\/?(\/|[^.].*)?$'

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Modify the pmb.php script to validate the url parameter against a whitelist of allowed domains (e.g., only internal or trusted external domains).
2. Disable Script: If the redirect functionality is not required, disable or remove the /opac_css/pmb.php script.
3. WAF Rules: Deploy a web application firewall rule to block requests with a url parameter pointing to external domains.

Long-Term Fix:

• Upgrade to a patched version of PMB when available. Monitor the vendor's website or GitHub repository for updates.
• Consider migrating to a supported library management system if PMB is no longer maintained.

Detection:

• Implement the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.
• Regularly review web server logs for suspicious redirect patterns.

Valters IT

{/* [Security Hash: CD32C287331C3ADBEDBC322C] */}