Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is following code vulnerable? If yes, how it can be exploited?

 <%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = (String)request.getAttribute("someSiteUrl");

if(redirectToSomeSite != null && redirectToSomeSite.booleanValue()) {
response.sendRedirect(someSiteUrl); 
 }else{
%>
<jsp:forward page="SomeAction.do?param1=value1" />
<% } %>
share|improve this question

closed as too localized by Polynomial, Iszi, Rook, Rory Alsop Sep 25 '12 at 23:53

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
yep, obviously an owasp top 10 violation. –  Rook Sep 25 '12 at 16:19
1  
Are you trying to develop a customizable redirect page where you can record someone using the link prior to performing the redirect? If yes, I wonder if adding validation checks in your code to the URL being redirected to might remove the cross-site vulnerability? –  HeatfanJohn Sep 25 '12 at 16:40
    
@HeatfanJohn: Not exactly! I am just trying to exploit this piece of code using any proxy tool. I am wondering if we can tamper/modify request.getAttribute() as do request.getParamter()? –  p_upadhyay Sep 25 '12 at 19:43

2 Answers 2

up vote 2 down vote accepted

getParameter() returns http request parameters. Those passed from the client to the server. For example http://site.com/servlet?parameter=1. Can only return String

getAttribute() is for server-side usage only - you fill the request with attributes that you can use within the same request. For example - you set an attribute in a servlet, and read it from a JSP. Can be used for any object, not just string.

So the simple answer for your question is no, you cannot exploit request.getAttribute() with a proxy, since you don't have access to the server inner processes. This is of course true only if the rest of the program is secured and you can trust the attributes you're requesting.

share|improve this answer

Looks like there might be a open-redirect vulnerability. This might mean an attacker could craft a link with your URL and make your web site redirect the user to a malicious page. The user, just seeing the 'trusted' website belonging to you, gets redirected to the malicious webpage, which might mount an attack such as a CSRF/XSS. So although this code does not have any vulnerability by itself, it can be used to launch other serious attacks.

Reference: CWE 601

share|improve this answer
    
+1, Also an owasp top 10 violation. –  Rook Sep 25 '12 at 16:20
    
@asudhak: I am wondering if we can exploit request.getAttribute() as we do request.getParameter() using any proxy tool or firefox add on? –  p_upadhyay Sep 25 '12 at 19:41
1  
-1 Value from request.getAttribute can not be directly tempered by request data unless the developer sets any data from request directly to the named attribute being used for redirect URL. –  Sachin Kumar Apr 5 '13 at 11:46
    
@SachinKumar Thats what the above code is actually doing –  sudhacker Apr 9 '13 at 20:23
    
@asudhak request.getAttribute and request.getParameter do different things .. code above is reading attribute and not the parameter. –  Sachin Kumar Apr 22 '13 at 11:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.