3

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.

POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com

mail_to=support%40support.com&subject=Feedback+Form&done_url=http://phishingsite.com&feedback=I+love+your+site&Submit=Submit

I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/

But how would an attacker exploit this redirect in the POST body?

| improve this question | |
  • I doubt that you could exploit it just as is. Probably you would need to chain it with some other bugs, something like DOM Clobbering (I'm thinking about possible dom clobbering attack in bb tags (used on blogs / forums / ....)) (if you could use name / id attribute too) & bypassing some URL fitlers on that site (so you cannot just insert arbitrary URL in [url] bb tag: [url="any_url"]clickme[/url]). Imho no general solution possible here, so you'll need to be very case speicific. – Awaaaaarghhh May 1 at 11:15
  • E.g. if that application is using PHP and $_REQUEST is used instead of $_GET / $_POST, then you could convert that attack to GET and make it easily exploitable. – Awaaaaarghhh May 1 at 11:21
3

Usually you would need to have this in a GET for it to be exploitable (in the sense of being able to redirect the user to an arbitrary URL after they've visited the link), however a couple of points occur about this

  • It might be possible to convert the POST to a GET and still have it process correctly, depends on the server-side logic.
  • That form may well have another issue which is that the target of the main is specified as a parameter. If an attacker can modify that parameter then they can use this form to send spam to arbitrary addresses. From a security standpoint the mail_to parameter should be held server-side not sent from the client (if it has to be sent from the client it should be white-list validated before the e-mail is actually sent)
| improve this answer | |
  • 1
    Rory- you're completely correct. The only foreseeable method that this could be used as Phishing open redirect would be if it could be converted to a GET request, since the whole premise of the phishing attack relies on the victim seeing & trusting the link, and the hostname in the URL. – eliteparakeet Sep 10 '13 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.