Difference between revisions of "Open redirect"

Jump to: navigation, search
Line 2: Line 2:
[[ASDR Table of Contents]]
[[ASDR Table of Contents]]
Line 9: Line 8:
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
[[Category:FIXME|Stub article, needs review]]
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]

Revision as of 08:31, 19 February 2009

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.ASDR Table of Contents

Last revision (mm/dd/yy): 02/19/2009


An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.



Platform All web platforms affected

Risk Factors




The phishing use can be more complex, using complex encoding:

Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com

Facked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system

Related Attacks

Related Vulnerabilities

Related Controls

  • To avoid the open redirect vulnerability parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.

The server must have a relation of the authorized redirections (i.e. in a database)

Related Technical Impacts