This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Open redirect"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
 +
{{Template:Stub}}
 +
 +
 +
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 +
 +
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
Line 10: Line 16:
 
==Description==
 
==Description==
  
−
A vulnerability is a weakness in an application (frequently a broken or missing control) that enables an attack to succeed. Be sure you don't put [attacks] or [controls] in this category.
+
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
 +
 
 +
'''Consequences'''
 +
 
 +
[[Phishing]]
  
−
# Start with a one-sentence description of the vulnerability
+
'''Platform'''
−
# What is the problem that creates the vulnerability?
+
All web platforms affected
−
# What are the attacks that target this vulnerability?
 
−
# What are the technical impacts of this vulnerability?
 
  
  
 
==Risk Factors==
 
==Risk Factors==
  
−
* Talk about the [[OWASP Risk Rating Methodology|factors]] that make this vulnerability likely or unlikely to actually happen
+
TBD
−
* Discuss the technical impact of a successful exploit of this vulnerability
 
−
* Consider the likely [business impacts] of a successful attack
 
−
 
 
  
 
==Examples==
 
==Examples==
  
−
===Short example name===
+
http://www.vulnerable.com?redirect=http://www.attacker.com
−
: A short example description, small picture, or sample code with [http://www.site.com links]
 
  
−
===Short example name===
+
The phishing use can be more complex, using complex encoding:
−
: A short example description, small picture, or sample code with [http://www.site.com links]
 
  
 +
Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com
 +
 +
Facked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system
  
 
==Related [[Attacks]]==
 
==Related [[Attacks]]==
Line 42: Line 48:
 
==Related [[Vulnerabilities]]==
 
==Related [[Vulnerabilities]]==
  
−
* [[Vulnerability 1]]
+
* [[Open forward]]
−
* [[Vulnerabiltiy 2]]
 
  
 
==Related [[Controls]]==
 
==Related [[Controls]]==
  
−
* [[Control 1]]
+
* To avoid the open redirect vulnerability parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.
−
* [[Control 2]]
+
 
 +
The server must have a relation of the authorized redirections (i.e. in a database)
  
  
Line 58: Line 64:
  
 
==References==
 
==References==
−
Note: A reference to related [http://cwe.mitre.org/ CWE] or [http://capec.mitre.org/ CAPEC] article should be added when exists. Eg:
 
  
−
* [http://cwe.mitre.org/data/definitions/79.html CWE 79].
+
TBD
−
* http://www.link1.com
 
−
* [http://www.link2.com Title for the link2]
 
  
 
[[Category:FIXME|add links
 
[[Category:FIXME|add links
Line 94: Line 97:
  
 
[[Category:OWASP ASDR Project]]
 
[[Category:OWASP ASDR Project]]
−
 
−
==Overview==
 
−
 
−
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
 
−
 
−
{{Template:Stub}}
 
−
 
−
==Consequences ==
 
−
 
−
[[Phishing]]
 
−
 
−
==Exposure period ==
 
−
 
−
==Platform ==
 
−
All web platforms affected
 
−
 
−
==Required resources ==
 
−
 
−
==Severity ==
 
−
 
−
 
−
==Likelihood of exploit ==
 
−
 
−
 
−
==Avoidance and mitigation ==
 
−
To avoid the open redirect vulnerability parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.
 
−
 
−
The server must have a relation of the authorized redirections (i.e. in a database)
 
−
 
−
==Discussion ==
 
−
 
−
 
−
==Examples ==
 
−
 
−
http://www.vulnerable.com?redirect=http://www.attacker.com
 
−
 
−
The phishing use can be more complex, using complex encoding:
 
−
 
−
Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com
 
−
 
−
Facked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system
 
−
 
−
==Related problems ==
 
−
 
−
* [[Open forward]]
 
−
 
 
[[Category:Vulnerability]]
 
[[Category:Vulnerability]]

Revision as of 14:04, 27 September 2008

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page. 

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.


Last revision (mm/dd/yy): 09/27/2008

Vulnerabilities Table of Contents

ASDR Table of Contents


Description

An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.

Consequences

Phishing

Platform All web platforms affected


Risk Factors

TBD

Examples

http://www.vulnerable.com?redirect=http://www.attacker.com

The phishing use can be more complex, using complex encoding:

Real redirect: http://www.vulnerable.com/redirect.asp?=http://www.links.com

Facked link: http://www.vulnerable.com/security/advisory/23423487829/../../../redirect.asp%3F%3Dhttp%3A//www.facked.com/advisory/system_failure/password_recovery_system

Related Attacks


Related Vulnerabilities

Related Controls

  • To avoid the open redirect vulnerability parameters of the application script/program must be validated before sending 302 HTTP code (redirect) to the client browser.

The server must have a relation of the authorized redirections (i.e. in a database)


Related Technical Impacts


References

TBD

Retrieved from "https://wiki.owasp.org/index.php?title=Open_redirect&oldid=41288"