@joe is correct about the nature of the attack (+1) yet there's a little more to it. Namely, whose issue it is and why the issue happens.
Using the same example, let us say that
example.com uses a redirect script, say,
example.com/redirect.php that receives the parameter
url and then performs an HTTP 302 (or 301) to the URL that is contained in the
url parameter. Now, let us also say that
example.com contains user generated content, including URL to which the users link.
When a user posts a URL on
example.com displays this URL as:
But why does
example.com display the URL in that way instead of the plain URL? Because
redirect.php collects statistics about the links the users click.
So, what is the problem? The problem is that I can add a URL on some other website that also hosts user content, completely unrelated to
example.com, say on
facebook.com that reads:
And the user will click that thinking that it is a link leading to
Browsers often shorten long URLs but leave the domain in full, and some forums even make a domain stand out of a link; all that to prevent phishing through links into dodgy websites. But in the example above
example.com has destroyed these safeguards and will allow any website to be redirected to, whilst the domain you see when hovering over the link is always
The above is a problem of
example.com and this doiman therefore should be classified as unsafe to browse to even that it does not contain any malicious content.
Instead of using an unchecked redirect,
example.com should either make a whitelist of domains to which
redirect.php can be used, or make domains in the
url parameter stand out (e.g. prepend the domain in a high contrast colour) before the link itself and require a proper
Referer: header during the redirect (so redirects can only happen from
example.com itself). Preferably, it should preform both fixes.