CVE-2023-33405: Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.

PriorityP346medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EXPLOIT

EPSS

31.26%

98.1th percentile

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
blogengine	blogengine.net	<= 3.3.8.0	—

Detection & IOCsextracted from sources · hover to see the quote

url/default.aspx?years=http://oast.pro↗

yara↗

(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$

→The open redirect is triggered via the `years` GET parameter on `/default.aspx`. Monitor HTTP requests to this endpoint where the `years` parameter contains an absolute URL (http:// or //) pointing to an external host. ↗
→Detect exploitation by inspecting HTTP response `Location` headers for redirects to external domains originating from `/default.aspx?years=` requests. The regex `(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$` matches the redirect response header. ↗
→Use Shodan/FOFA queries to identify exposed BlogEngine.net instances as potential targets: Shodan `http.html:"blogengine.net"`, FOFA `body="blogengine.net"`. ↗

·Affected versions are BlogEngine.net 3.3.8.0 and earlier. The vulnerability requires no authentication (PR:N) but does require user interaction (UI:R), consistent with a phishing/redirect abuse scenario. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.