Exploiting an Open Redirect in POST body?

Question

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.

POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com

mail_to=support%40support.com&subject=Feedback+Form&done_url=http://phishingsite.com&feedback=I+love+your+site&Submit=Submit

I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/

But how would an attacker exploit this redirect in the POST body?

Answer 1

Usually you would need to have this in a GET for it to be exploitable (in the sense of being able to redirect the user to an arbitrary URL after they've visited the link), however a couple of points occur about this

• It might be possible to convert the POST to a GET and still have it process correctly, depends on the server-side logic.
• That form may well have another issue which is that the target of the main is specified as a parameter. If an attacker can modify that parameter then they can use this form to send spam to arbitrary addresses. From a security standpoint the mail_to parameter should be held server-side not sent from the client (if it has to be sent from the client it should be white-list validated before the e-mail is actually sent)

Answer 2

Whatever could be done is irrelevant, since protecting such links is cheap and simple.

Pleas review this post, which proposes a general solution: Adding a security-token or none none.