0

I found a website that has the parameter post_login_redirect= I can change to any existing and non-exisiting subdomains, but there is no possibility to redirect to another domain. The redirect occurs after the user logs in.

For example:

we have sub.domain.com and we can change to anything if we respect the domain.com. so we can redirect to a.b.c.b.domain.com even if that subdomain doesn't exist, it will redirect anyway. But we can't redirect to a.hello.com

This is not an open redirect issue, because we can only redirect to subdomains that we don't own.

Is there any possibility to chain this or make this a real vulnerability?

|improve this question
0

Who would be affected if this was a valid Open redirect attack, if it only redirects to its subdomains. If we can redirect it to a subdomain that then navigates the user to an untrusted domain, we can speak about a valid Open Redirection attack.

Low: post_login_redirect=sub.domain.com
High: post_login_redirect=sub.domain.com/?a=http://www.untrust.ed
|improve this answer
  • but i don't see the impact of redirecting to a subdomain. there is no demage on that. – Tomi Begher Jun 26 '19 at 20:40
  • Hmm, your problem explaination is a bit confusing, is it the path "post_login_redirect=" that is the problem or the fact that you are able to redirect whatever subdomain you want to the original domain? – user211258 Jun 26 '19 at 21:00
  • i am able to redirect to any subdomain, even if it exist or doesn't exist. i don't know if i should report that or not to the program i am in, because i don't really consider it a vulnerability if i don't have the ability to redirect to other domains. – Tomi Begher Jun 27 '19 at 1:51
  • If It does not directly lead to any abuse, and there is no damage on one of these subdomains, that eventually can conspire with this, also if it is not usable in phishing attacks. thereby we don't know if it was their choiche to become such thing(it can have a specific function that we don't know). the fact that you can redirect the querystring of "post_login_redirect=" would have a too low inpact to even report that as a valid vuln, i would label it as just info – user211258 Jun 27 '19 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.