This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Open redirect"

From OWASP
Jump to: navigation, search
 
(9 intermediate revisions by 4 users not shown)
Line 1: Line 1:
{{Template:Vulnerability}}
+
#REDIRECT [[Unvalidated_Redirects_and_Forwards_Cheat_Sheet]]
{{Template:Stub}}
 
 
 
 
 
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 
 
 
 
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 
 
 
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 
 
 
[[ASDR Table of Contents]]
 
__TOC__
 
 
 
[[Category:FIXME|Stub article, needs review]]
 
 
 
 
 
==Description==
 
 
 
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
 
 
 
'''Consequences'''
 
 
 
[[Phishing]]
 
 
 
'''Platform'''
 
All web platforms affected
 
 
 
 
 
==Risk Factors==
 
 
 
TBD
 
 
 
==Examples==
 
 
 
http://www.vulnerable.com?redirect=http://www.attacker.com
 
 
 
The phishing use can be more complex, using complex encoding:
 
 
 
Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com
 
 
 
Facked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system
 
 
 
==Related [[Attacks]]==
 
 
 
* [[Attack 1]]
 
* [[Attack 2]]
 
 
 
 
 
==Related [[Vulnerabilities]]==
 
 
 
* [[Open forward]]
 
 
 
==Related [[Controls]]==
 
 
 
* To avoid the open redirect vulnerability parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.
 
 
 
The server must have a relation of the authorized redirections (i.e. in a database)
 
 
 
 
 
==Related [[Technical Impacts]]==
 
 
 
* [[Technical Impact 1]]
 
* [[Technical Impact 2]]
 
 
 
 
 
==References==
 
 
 
TBD
 
 
 
[[Category:FIXME|add links
 
 
 
In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 
 
 
Availability Vulnerability
 
 
 
Authorization Vulnerability
 
 
 
Authentication Vulnerability
 
 
 
Concurrency Vulnerability
 
 
 
Configuration Vulnerability
 
 
 
Cryptographic Vulnerability
 
 
 
Encoding Vulnerability
 
 
 
Error Handling Vulnerability
 
 
 
Input Validation Vulnerability
 
 
 
Logging and Auditing Vulnerability
 
 
 
Session Management Vulnerability]]
 
 
 
__NOTOC__
 
 
 
 
 
[[Category:OWASP ASDR Project]]
 
[[Category:Vulnerability]]
 

Latest revision as of 00:26, 21 September 2016