Medium Severity
Open redirect: Klaviyo
Description
Message contains use of the Klaviyo (kmail-lists.com) open redirect, but the link display text does not match known permutations. This has been exploited in the wild.
References
No references.
Sublime Security
Created May 14th, 2024 • Last updated May 14th, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and any(body.links,
.href_url.domain.domain == 'manage.kmail-lists.com'
and .href_url.path =~ '/subscriptions/subscribe/update'
and strings.icontains(.href_url.query_params, 'r=')
and not strings.ilike(.display_text, "*subscribe*", "*manage*")
)
Playground
Test against your own EMLs or sample data.