0

If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' reflecting my initial Host header input.

Does that make this a form of 'open redirect'? And is a 2xx or 3xx response status a sign that the webserver is vulnerable to DNS rebinding attacks?

I think if the requested Host is unknown to the webserver a 4xx or 5xx or dropped connection should be the appropriate reply.

1 Answer 1

2

Does that make this a form of 'open redirect'?

Open redirect vulnerabilities are about redirecting the user through a seemingly trusted link to a malicious site by misusing a broken redirect feature of the trusted site. There is no trusted site as a starting point involved here though in the first place: it already starts with the malicious site pointing its IP address to the trusted site and then having a URL with this malicious site as hostname in the URL - otherwise the malicious site would not show up in the host header to the trusted site.

And is a 2xx or 3xx response status a sign that the webserver is vulnerable to DNS rebinding attacks?

No DNS lookups are done by the webserver here, the value is just reflected from the Host header. No DNS lookups done by the webserver means that there is no DNS rebinding vulnerability involved here.

I think if the requested Host is unknown to the webserver a 4xx or 5xx or dropped connection should be the appropriate reply.

Correct, the server should not accept arbitrary Host headers but only the ones it is actually responsible for.

See also Exploiting HTTP redirect function via the Host header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .