3

The OWASP example for Unvalidated Redirects and Forwards says that:

The application has a page called “redirect.jsp” which takes a single parameter named “url”. The attacker crafts a malicious URL that redirects users to a malicious site that performs phishing and installs malware.

How does an attacker crafts a malicious URL and forces it on the victim? If one goes to foo.bar, fills a form and submits it, how can one be redirected to amalicious site?

2

Lets say there is a url called www.example.com/redirect.jsp?url=www.example.com/login that is used to redirect to the login page. I craft a link to www.example.com/redirect.jsp?url=www.myphishingsite.com/login which redirects to my phishing site. People look at the domain name and think its legit. It can also be used to DOS something and conceal your identity from the target. There is no form involved.

1

@joe is correct about the nature of the attack (+1) yet there's a little more to it. Namely, whose issue it is and why the issue happens.

Using the same example, let us say that example.com uses a redirect script, say, example.com/redirect.php that receives the parameter url and then performs an HTTP 302 (or 301) to the URL that is contained in the url parameter. Now, let us also say that example.com contains user generated content, including URL to which the users link.

When a user posts a URL on example.com, say, http://mywebsite.com/myarticle/, then example.com displays this URL as:

href="http://example.com/redirect.php?url=http://mywesite.com/myarticle"

But why does example.com display the URL in that way instead of the plain URL? Because redirect.php collects statistics about the links the users click.

So, what is the problem? The problem is that I can add a URL on some other website that also hosts user content, completely unrelated to example.com, say on facebook.com that reads:

http://example.com/redirect.php?url=http://myphishingwebsite.com/script.php

And the user will click that thinking that it is a link leading to example.com.

Browsers often shorten long URLs but leave the domain in full, and some forums even make a domain stand out of a link; all that to prevent phishing through links into dodgy websites. But in the example above example.com has destroyed these safeguards and will allow any website to be redirected to, whilst the domain you see when hovering over the link is always example.com.


Solution

The above is a problem of example.com and this doiman therefore should be classified as unsafe to browse to even that it does not contain any malicious content.

Instead of using an unchecked redirect, example.com should either make a whitelist of domains to which redirect.php can be used, or make domains in the url parameter stand out (e.g. prepend the domain in a high contrast colour) before the link itself and require a proper Referer: header during the redirect (so redirects can only happen from example.com itself). Preferably, it should preform both fixes.

0

There are two problems with theses redirects:

1) Leak of origin

Let's say that you wrote an (insecure) web server that at one point puts the username & password of a user in a URL (i.e. a GET request). A redirect would tell a malicious where a user came from, letting them extract their credentials from the URL.

2) False sense of trust

Users can get redirected to a phishing site without knowing. A cautious user could be using the legit site and suddenly be redirected to a malicious site without them knowing. This user would continue to use the site like normal, possibly having already checked the URL, etc. I don't know about you, but I don't check the URL every time I move around a website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.