Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.

POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com

mail_to=support%40support.com&subject=Feedback+Form&done_url=http://phishingsite.com&feedback=I+love+your+site&Submit=Submit

I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/

But how would an attacker exploit this redirect in the POST body?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Usually you would need to have this in a GET for it to be exploitable (in the sense of being able to redirect the user to an arbitrary URL after they've visited the link), however a couple of points occur about this

  • It might be possible to convert the POST to a GET and still have it process correctly, depends on the server-side logic.
  • That form may well have another issue which is that the target of the main is specified as a parameter. If an attacker can modify that parameter then they can use this form to send spam to arbitrary addresses. From a security standpoint the mail_to parameter should be held server-side not sent from the client (if it has to be sent from the client it should be white-list validated before the e-mail is actually sent)
share|improve this answer
    
Rory- you're completely correct. The only foreseeable method that this could be used as Phishing open redirect would be if it could be converted to a GET request, since the whole premise of the phishing attack relies on the victim seeing & trusting the link, and the hostname in the URL. –  eliteparakeet Sep 10 '13 at 21:09

Whatever could be done is irrelevant, since protecting such links is cheap and simple.

Pleas review this post, which proposes a general solution: Adding a security-token or none none.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.