I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.

POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com


I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/

But how would an attacker exploit this redirect in the POST body?


Usually you would need to have this in a GET for it to be exploitable (in the sense of being able to redirect the user to an arbitrary URL after they've visited the link), however a couple of points occur about this

  • It might be possible to convert the POST to a GET and still have it process correctly, depends on the server-side logic.
  • That form may well have another issue which is that the target of the main is specified as a parameter. If an attacker can modify that parameter then they can use this form to send spam to arbitrary addresses. From a security standpoint the mail_to parameter should be held server-side not sent from the client (if it has to be sent from the client it should be white-list validated before the e-mail is actually sent)
  • Rory- you're completely correct. The only foreseeable method that this could be used as Phishing open redirect would be if it could be converted to a GET request, since the whole premise of the phishing attack relies on the victim seeing & trusting the link, and the hostname in the URL. – eliteparakeet Sep 10 '13 at 21:09

Whatever could be done is irrelevant, since protecting such links is cheap and simple.

Pleas review this post, which proposes a general solution: Adding a security-token or none none.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.