{"id":235875,"date":"2020-08-28T17:27:19","date_gmt":"2020-08-28T15:27:19","guid":{"rendered":"https:\/\/emariete.com\/?p=235875"},"modified":"2020-08-28T17:27:19","modified_gmt":"2020-08-28T15:27:19","slug":"vulnerability-meteotemplate-as-affects-each-other","status":"publish","type":"post","link":"https:\/\/emariete.com\/en\/vulnerabilidad-meteotemplate-como-afecta-seo\/","title":{"rendered":"Vulnerability in Meteotemplate and how it affects SEO"},"content":{"rendered":"

\r\n\r\n \r\n \r\n
\r\n
\r\n \"\"English (UK)<\/span><\/a> \r\n \r\n <\/svg>\r\n <\/div>\r\n <\/div>\r\n\r\n \r\n
\r\n
\r\n
\"\"English (UK)<\/span><\/div> \r\n \r\n <\/svg>\r\n <\/div>\r\n \r\n
\r\n \r\n \"\" Espa\u00f1ol<\/span>\r\n <\/a>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/div>\r\n<\/b><\/p>\n

<\/b><\/p>\n

Vulnerability in Meteotemplate<\/h2>\n

What is Meteotemplate?<\/h2>\n

Meteotemplate en <\/span>a software package<\/strong>or template, which hundreds of amateur weather stations around the world use to create comprehensive and eye-catching web pages with weather data.<\/span><\/p>\n

My weather station<\/a> sends its data to the internet, for several years now with the help of a Raspberry Pi, WeeWx open source software, and the Meteotemplate template<\/a>.<\/a><\/p>\n

I recently discovered while analysing data from the eMariete.com server that was receiving rather suspicious traffic<\/strong>. I looked into it and discovered that the problem was in Meteotemplate.<\/p>\n

Meteotemplate has an open redirect vulnerability<\/strong> (technically called CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]<\/em>) which makes \"the bad guys<\/em>\"can use it to committing their misdeeds<\/strong> (mainly attacks\u00a0of phishing, <\/strong>but is usable for many more types of attack and traffic and link masking).<\/p>\n

<\/div>\n
<\/div>\n
<\/div>\n
<\/div>\n

The CCN-157548 vulnerability<\/h2>\n

CCN-157548 is the code given for this vulnerability in the vulnerability catalogues<\/a>\u00a0with which the cybersecurity companies.<\/strong><\/p>\n

\"Vulnerability<\/a><\/strong><\/p>\n

This vulnerability (of type \u2018Open Redirect<\/strong>\u2018)<\/em> what allows the attacker to construct a URL with a given format<\/strong> which, apparently, points to a completely normal and legal website, but when the user clicks on it, he\/she is redirected to the website of the attacker's choice.<\/strong>.<\/p>\n

Exploiting a vulnerability like this greatly simplifies phishing attacks, since it<\/strong>\u00a0the name of the server in the manipulated link is identical<\/strong> al of the site \"legal<\/em>\"which makes the links have a harmless appearance<\/strong>.<\/p>\n

The link may contain a parameter<\/strong> for the web application to redirect<\/strong> the request to the specified URL. By modifying that URL, which points to the malicious site, an attacker can successfully run a phishing scam and steal the user's credentials.<\/p>\n

Open redirection, or Open Redirect, is a bug in this programme<\/strong>which allows attackers to redirect users to malicious websites.<\/p>\n

An example of exploitation of this vulnerability would be where the attacker, in order to impersonate your bank, creates a link like https:\/\/tubanco.com\/entrar<\/em><\/span>\u00a0and when the user clicks on it is redirected to the web page that\u00a0<\/strong>would like to\u00a0<\/span>the attacker<\/strong>.<\/span><\/p>\n

If our website https:\/\/myweb.com<\/strong>\/enter<\/em><\/span>\u00a0<\/em>is vulnerable, the bad guy<\/em> create a URL such as\u00a0https:\/\/myweb.com<\/strong>\/enter\/redirect.php?https:\/\/elsitiodelmalo.com<\/span>\u00a0so that, when our unwary surfer clicks on the link, believing that he will come to our website, <\/em>actually go to the website of the bad guy<\/em><\/strong> (which can be passed off as for ours)<\/strong>\u00a0and request data from the user, for example.<\/p>\n

How to fix the Meteotemplate vulnerability?<\/h2>\n

When I discovered the vulnerability on 8 June 2020, I reported it in the official Meteotemplate forum<\/a> in the hope that Jachym<\/strong>The creator could fix it, but, unfortunately, he did, there was no response<\/strong>I have not received any comments, neither from Jachym nor from any other user (it seems that Jachym has deleted my post).<\/p>\n

A month and a half later, the 21 August 2020<\/strong>I insisted again, adding more information, which I had discovered, and publishing a list of affected sites, so that they could see that there were thousands. There was no response either.<\/strong><\/p>\n

On 25 August I opted for make it public in Meteoclimatic<\/a>which is the largest forum for meteorology enthusiasts in Spain<\/strong>and where many of them use this software. They immediately paid attention and in less than 24 hours, the user jmviper<\/span><\/a><\/span> published<\/strong>\u00a0the code of redirect.php,<\/strong>\u00a0<\/span>which you can see below,\u00a0<\/span>fixing the vulnerability in Meteotemplate.<\/span><\/p>\n