3

The OWASP state that open redirect is a vulnerability:

An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.

However, it's trivial for an attacker to create a phishing URL and get it shortened, thus "get[ting] users to visit malicious sites without realizing it".

Does this mean that all URL shorteners (e.g bit.ly, goo.gl, etc) are by definition vulnerable?

How can a URL shortener be fixed/modified such that it does not violate OWASP?

3
  • 2
    All URL shorteners are a way of obfuscating links, yes. As it’s precisely what they’re meant to do, it’s not really a vulnerability, but they should be scoured from the face of the planet either way for stripping pages of HTTPS, hiding destinations, and making dead links.
    – Ry-
    Jun 6, 2014 at 16:21
  • 2
    Also, don't consider OWASP as some magical black and white territory where it's either a vulnerability or not. All vulnerabilities are to be considered in context. JSFiddle outputs unescaped javascript, but (hopefully) nobody considers that an XSS!
    – David
    Jun 11, 2014 at 20:47
  • I constantly worry about getting redirected to somewhere malicious via a shortened link. Shameless plug but I created this out of pure paranoia - unshorten.link It's a Chrome extension that detects when you click on a shortened link, intercepts it then tells you where the link is actually sending you. Shameless plug.
    – jmbmxer
    Jan 20, 2015 at 5:57

7 Answers 7

6

Abusing an open redirect would be when I would receive a phishing email like this:

From: "Example.com Admin" <[email protected]>

Hello [ENTER TARGET NAME HERE]

I am the admin of example.com and we need you to enter your example.com username 
and password for totally justified reason on 
https://example.com/redirect.php?172156214

I look at the link in the email and see that it indeed leads to example.com and not to somewhere else. I am a regular example.com member so I trust that website. It's even a https-link and that computer magazine told me those are super-secure. So I click on it.

However, what I don't know is that redirect.php is a script which allows anyone to create a redirect-url to any url they want. When I click on the link I get redirected to http://example.com.totallylegitloginpagereallytrustme.ru/notinfestedwithmalwareatall.html. When the URL shortener is one of those which use a full-screen iframe to hide the destination URL I don't even see that URL. But even when it doesn't, I might not verify it because I already verified that it is indeed example.com in the email. So I will enter my username and password.

A domain which is used for link shortening usually isn't used for anything else. But when it is, it is vulnerable for attempts to phish accounts for that domain itself.

4
  • So you are saying that they violate OWASP top 10 and are by definition vulnerable?
    – Pacerier
    Jun 6, 2014 at 17:54
  • 2
    @Pacerier When I don't know the domain then it could be malicious even without redirecting and I will be cautious anyway when visiting it. Or I know it is an open redirector, so I know that I don't know where it takes me and I will be equally cautious. It is only a real vulnerability when I know the domain but I am unaware that it also offers a hidden redirect service.
    – Philipp
    Jun 6, 2014 at 18:16
  • But is it true that regardless of your knowledge, OWASP would still label it as a violator?
    – Pacerier
    Jun 6, 2014 at 18:50
  • @Pacerier I can not speak on behalf of the OWASP project.
    – Philipp
    Jun 6, 2014 at 18:59
7

URL shorteners meet the definition of sites with open redirect vulnerability, yes, but it would be perverse to describe them as vulnerable when their sole purpose is to act as an open redirect.

2
  • Wait, so their the sole purpose is to be vulnerable?
    – Pacerier
    Jun 6, 2014 at 16:29
  • 1
    Their sole purpose is to perform redirects. I'm not sure it even falls under the without validation piece, since by definition, the website knows exactly where it is sending you, and is sending you there every time. If anything, bit.ly surely validates the data (is it a valid url?), and any real url is indeed valid.
    – Yablargo
    Jun 11, 2014 at 21:47
4

"Vulnerable" means that it can be used by an attacker for some purpose other than the one intended by the author. Because URL shorteners are purpose-built as open redirects, they are by definition, not vulnerable.

When users see a tinyurl.com link or a t.co link, they don't assume that the link is to a page hosted by tinyurl or twitter. In fact, this is specifically why URL shorteners run by major websites (t.co for twitter, goo.gl for google, fb.me for facebook, etc.) use a different domain name from the one run by the site.

In fact, google runs two URL shorteners; goo.gl is for anyone to use, while g.co is only used for official business with links to Google destinations, specifically to allow users to evaluate a link at-a-glance.

If someone is able to use YOUR site as an on-demand URL redirection service, and you haven't set it up exclusively for that purpose, then that can be a real issue.

4
  • @Pacerier Who cares. If you want opinions about the security of your site, there's no end of sources willing to share.
    – tylerl
    Jan 23, 2015 at 3:58
  • Security is only a means to an end. There are economic reasons to get an app labeled "OWASP-compliant".
    – Pacerier
    Jan 23, 2015 at 6:40
  • Security and compliance are orthogonal. If compliance is your goal, then you should be asking OWASP directly about the compliance aspect, as the security of your system is not directly relevant.
    – tylerl
    Jan 23, 2015 at 8:30
3

The rule states that it is unvalidated destination. In the case of the url shortener, it is one specific and absolutely validated destination. If I go to bit.ly/?ABCDEFG -- it is always going to take me to the same place. This is by definition the function of the service.

Above poster has it right. If I can send you a link to www.ibm.com/?id=AKJSHDKAHDAKSDHAKSHDAKSHDKSADKAHD&redir=www.haxx0rs.net so that it is not obvious that I'm not going to ibm.com, then we have an issue. The shortener's only purpose is to redirect, and the link will always take you to the same place.

2

The difference is, that a URL shortener is never a user's destination. Instead, he uses it to get to a destination. Therefore he most likely will check where the shortened URL has brought him. On the other hand, if the user already is on his destination page, then a redirect can be very harmful, because the user might not be aware of this redirect (new page looks the same) and therefore not check his new destination.

The only argument where I would follow is that a URL shortener in a mail has some psychological advantage: On first glance, the victim sees that the URL is a shortener and might be curious to click it. When redirected, the victim at first will pay attention to how the page looks (e.g. youtube layout), and might not check on the exact URL anymore (as he would have done in the mail).

But saying that a URL shortener is vulnerable because it redirects to an unvalidated page is like saying that a web application where users can test their JavaScript code is prone to XSS. Its not a vulnerability, its a purpose.

1

To answer "How can a URL shortener be fixed/modified such that it does not violate OWASP?" - Run your own URL shortening service as securely as possible and you won't have to worry about using someone elses. Example off the top of my head, feel free to google around for other solutions, or whip up your own tool (Fairly simple project really): https://github.com/sluu99/shawty

1
  • Right, but of course the question was referring to a third-party URL shortener if it wasn't explicit enough....
    – Pacerier
    Jun 12, 2014 at 3:57
1

Yes you are correct and that "is" considered a vulnerability and or a usable exploit. although link shortner providers will say otherwise because there is all ready a fix for this, See services like to is used for hyper linking and a less cluttered text. To be safe and fix this all you must do is right click the link and click copy copy clink location and paste it into notepad for example. Sometimes you can just hover over the link.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .