Difference between revisions of "Open redirect"

From OWASP
Jump to: navigation, search
(Undo revision 126434 by Robert Hof (talk))
 
(10 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 +
{{Template:Stub}}
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
 +
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
 
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
  
[[ASDR Table of Contents]]
+
==Description==
__TOC__
+
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
  
 +
'''Consequences'''
  
==Description==
+
[[Phishing]]
  
A vulnerability is a weakness in an application (frequently a broken or missing control) that enables an attack to succeed. Be sure you don't put [attacks] or [controls] in this category.
+
'''Platform'''
 
+
All web platforms affected
# Start with a one-sentence description of the vulnerability
+
# What is the problem that creates the vulnerability?
+
# What are the attacks that target this vulnerability?
+
# What are the technical impacts of this vulnerability?
+
  
  
 
==Risk Factors==
 
==Risk Factors==
  
* Talk about the [[OWASP Risk Rating Methodology|factors]] that make this vulnerability likely or unlikely to actually happen
+
TBD
* Discuss the technical impact of a successful exploit of this vulnerability
+
* Consider the likely [business impacts] of a successful attack
+
 
+
  
 
==Examples==
 
==Examples==
  
===Short example name===
+
http://www.vulnerable.com?redirect=http://www.attacker.com
: A short example description, small picture, or sample code with [http://www.site.com links]
+
  
===Short example name===
+
The phishing use can be more complex, using complex encoding:
: A short example description, small picture, or sample code with [http://www.site.com links]
+
 
 +
Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com
  
 +
Faked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system
  
 
==Related [[Attacks]]==
 
==Related [[Attacks]]==
Line 42: Line 39:
 
==Related [[Vulnerabilities]]==
 
==Related [[Vulnerabilities]]==
  
* [[Vulnerability 1]]
+
* [[Open forward]]
* [[Vulnerabiltiy 2]]
+
  
 
==Related [[Controls]]==
 
==Related [[Controls]]==
  
* [[Control 1]]
+
* To avoid the open redirect vulnerability, parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.
* [[Control 2]]
+
  
 +
The server must have a relation of the authorized redirections (i.e. in a database).
  
 
==Related [[Technical Impacts]]==
 
==Related [[Technical Impacts]]==
Line 58: Line 54:
  
 
==References==
 
==References==
Note: A reference to related [http://cwe.mitre.org/ CWE] or [http://capec.mitre.org/ CAPEC] article should be added when exists. Eg:
 
  
* [http://cwe.mitre.org/data/definitions/79.html CWE 79].
+
TBD
* http://www.link1.com
+
* [http://www.link2.com Title for the link2]
+
  
 
[[Category:FIXME|add links
 
[[Category:FIXME|add links
Line 94: Line 87:
  
 
[[Category:OWASP ASDR Project]]
 
[[Category:OWASP ASDR Project]]
 
==Overview==
 
 
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
 
 
{{Template:Stub}}
 
 
==Consequences ==
 
 
[[Phishing]]
 
 
==Exposure period ==
 
 
==Platform ==
 
All web platforms affected
 
 
==Required resources ==
 
 
==Severity ==
 
 
 
==Likelihood of exploit ==
 
 
 
==Avoidance and mitigation ==
 
To avoid the open redirect vulnerability parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.
 
 
The server must have a relation of the authorized redirections (i.e. in a database)
 
 
==Discussion ==
 
 
 
==Examples ==
 
 
http://www.vulnerable.com?redirect=http://www.attacker.com
 
 
The phishing use can be more complex, using complex encoding:
 
 
Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com
 
 
Facked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system
 
 
==Related problems ==
 
 
* [[Open forward]]
 
 
 
[[Category:Vulnerability]]
 
[[Category:Vulnerability]]

Latest revision as of 12:36, 16 March 2012

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.


This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Last revision (mm/dd/yy): 03/16/2012

Vulnerabilities Table of Contents

Description

An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.

Consequences

Phishing

Platform All web platforms affected


Risk Factors

TBD

Examples

http://www.vulnerable.com?redirect=http://www.attacker.com

The phishing use can be more complex, using complex encoding:

Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com

Faked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system

Related Attacks


Related Vulnerabilities

Related Controls

  • To avoid the open redirect vulnerability, parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.

The server must have a relation of the authorized redirections (i.e. in a database).

Related Technical Impacts


References

TBD