2

I found a website that has the parameter post_login_redirect= I can change to any existing and non-exisiting subdomains, but there is no possibility to redirect to another domain. The redirect occurs after the user logs in.

For example:

we have sub.domain.com and we can change to anything if we respect the domain.com. so we can redirect to a.b.c.b.domain.com even if that subdomain doesn't exist, it will redirect anyway. But we can't redirect to a.hello.com

This is not an open redirect issue, because we can only redirect to subdomains that we don't own.

Is there any possibility to chain this or make this a real vulnerability?

2 Answers 2

2

Except for special circumstances (see below) or an especially high-security environment like online banking (then they should use a whitelist of destinations, or perhaps not redirect at all), I would say that this is not a risk worth mentioning. If you can't redirect to anything that is fully or even partially under the control of an attacker, there isn't really any risk.

There are quite a few things that might be attacked-controlled or influenced, though. Consider:

  • Can employees of the company request subdomains and run something insecure there?
  • Can you register a subdomain? (E.g. if it's a webhosting company.)
  • What if you enter an IP address instead of a (sub)domain? Can you format the IP like http://0x50.031101626?
  • Does the URL parser properly check the URL, e.g. is something like https://domain.com@hello.com recognized to be under the control of hello.com rather than domain.com?
  • Would switching protocols or using a different port help at all?
  • If desktops can be resolved with something like DESKTOP-9BA5A95.dyn.domain.com or 80-100-131-150.employees.domain.com, can employees request firewall exceptions? I.e. could someone with low privileges (the proverbial cleaning lady/man) setup a web server somewhere on one of these desktops and trick other users into using the redirect? (This sort of thing used to be more common in the past, probably almost non-existent in 2020.)
  • Some DNS resolvers and scummy ISPs (like the German Telekom) inject ads when a domain cannot be found. Can you redirect to a nonexistent subdomain like some-keyword.domain.com and buy an ad for some-keyword, hoping the user thinks the ad looks legitimate and clicks it?

There are quite a few options here, but some rely on other vulnerabilities being present and others won't be common or very practical.

1

Who would be affected if this was a valid Open redirect attack, if it only redirects to its subdomains. If we can redirect it to a subdomain that then navigates the user to an untrusted domain, we can speak about a valid Open Redirection attack.

Low: post_login_redirect=sub.domain.com
High: post_login_redirect=sub.domain.com/?a=http://www.untrust.ed
4
  • but i don't see the impact of redirecting to a subdomain. there is no demage on that. Jun 26, 2019 at 20:40
  • Hmm, your problem explaination is a bit confusing, is it the path "post_login_redirect=" that is the problem or the fact that you are able to redirect whatever subdomain you want to the original domain?
    – user211258
    Jun 26, 2019 at 21:00
  • i am able to redirect to any subdomain, even if it exist or doesn't exist. i don't know if i should report that or not to the program i am in, because i don't really consider it a vulnerability if i don't have the ability to redirect to other domains. Jun 27, 2019 at 1:51
  • If It does not directly lead to any abuse, and there is no damage on one of these subdomains, that eventually can conspire with this, also if it is not usable in phishing attacks. thereby we don't know if it was their choiche to become such thing(it can have a specific function that we don't know). the fact that you can redirect the querystring of "post_login_redirect=" would have a too low inpact to even report that as a valid vuln, i would label it as just info
    – user211258
    Jun 27, 2019 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.