CWE-601
AllowedURL Redirection to Untrusted Site ('Open Redirect')
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
2335 vulnerabilities reference this CWE, most recent first.
GHSA-774P-WGXM-FF63
Vulnerability from github – Published: 2022-05-17 03:18 – Updated: 2022-05-17 03:18An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later.
{
"affected": [],
"aliases": [
"CVE-2016-6657"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-16T09:59:00Z",
"severity": "HIGH"
},
"details": "An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later.",
"id": "GHSA-774p-wgxm-ff63",
"modified": "2022-05-17T03:18:01Z",
"published": "2022-05-17T03:18:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6657"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2016-6657"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94126"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-77CJ-RV5X-V6R2
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-21 16:36An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "fschat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.36"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-10908"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T16:36:57Z",
"nvd_published_at": "2025-03-20T10:15:21Z",
"severity": "MODERATE"
},
"details": "An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.",
"id": "GHSA-77cj-rv5x-v6r2",
"modified": "2025-03-21T16:36:57Z",
"published": "2025-03-20T12:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10908"
},
{
"type": "PACKAGE",
"url": "https://github.com/lm-sys/FastChat"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "FastChat open redirect vulnerability"
}
GHSA-77RV-6VFW-X4GC
Vulnerability from github – Published: 2019-03-14 15:39 – Updated: 2023-06-20 18:31Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.
A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint.
This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.17.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.17.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0.RELEASE"
},
{
"fixed": "2.1.4.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth2"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0.RELEASE"
},
{
"fixed": "2.1.4.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0.RELEASE"
},
{
"fixed": "2.2.4.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth2"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0.RELEASE"
},
{
"fixed": "2.2.4.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0.RELEASE"
},
{
"fixed": "2.3.5.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security.oauth:spring-security-oauth2"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0.RELEASE"
},
{
"fixed": "2.3.5.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-3778"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:22:03Z",
"nvd_published_at": "2019-03-07T18:29:00Z",
"severity": "MODERATE"
},
"details": "Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.\n\nA malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the \"redirect_uri\" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.\n\nThis vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. \n\nThis vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).",
"id": "GHSA-77rv-6vfw-x4gc",
"modified": "2023-06-20T18:31:23Z",
"published": "2019-03-14T15:39:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3778"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-attic/spring-security-oauth"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2019-3778"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227084837/http://www.securityfocus.com/bid/107153"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability"
}
GHSA-7893-2VG2-2738
Vulnerability from github – Published: 2025-05-22 18:31 – Updated: 2025-05-22 18:31CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
{
"affected": [],
"aliases": [
"CVE-2025-23183"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-22T16:15:53Z",
"severity": "MODERATE"
},
"details": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"id": "GHSA-7893-2vg2-2738",
"modified": "2025-05-22T18:31:15Z",
"published": "2025-05-22T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23183"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7899-W6C4-VQC4
Vulnerability from github – Published: 2025-05-05 17:03 – Updated: 2025-05-05 22:06Summary
A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced.
Details
In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new scrapingOptions object is not provided the allowRedirects property of opts.
PoC
- Publish a post containing a link to any URL that redirects on Misskey.
- A preview will be generated for the target of the redirect, despite Misskey passing
allowRedirects: false.
Impact
Misskey will follow redirects, despite explicitly requesting not to.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@misskey-dev/summaly"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.1"
},
{
"fixed": "5.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-46553"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-665",
"CWE-669",
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-05T17:03:20Z",
"nvd_published_at": "2025-05-05T19:15:56Z",
"severity": "LOW"
},
"details": "### Summary\nA logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn\u0027t enforced.\n\n### Details\nIn the main `summaly` function, a new `scrapingOptions` object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new `scrapingOptions` object is not provided the `allowRedirects` property of `opts`.\n\n### PoC\n- Publish a post containing a link to any URL that redirects on Misskey.\n- A preview will be generated for the target of the redirect, despite Misskey passing `allowRedirects: false`.\n\n### Impact\nMisskey will follow redirects, despite explicitly requesting not to.",
"id": "GHSA-7899-w6c4-vqc4",
"modified": "2025-05-05T22:06:39Z",
"published": "2025-05-05T17:03:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/misskey-dev/summaly/security/advisories/GHSA-7899-w6c4-vqc4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46553"
},
{
"type": "WEB",
"url": "https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed"
},
{
"type": "PACKAGE",
"url": "https://github.com/misskey-dev/summaly"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "@misskey-dev/summaly Redirect Filter Bypass"
}
GHSA-78FW-W53R-PGWG
Vulnerability from github – Published: 2025-04-15 15:30 – Updated: 2025-04-15 21:31Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
{
"affected": [],
"aliases": [
"CVE-2025-3522"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T15:16:09Z",
"severity": "MODERATE"
},
"details": "Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird \u003c 137.0.2 and Thunderbird \u003c 128.9.2.",
"id": "GHSA-78fw-w53r-pgwg",
"modified": "2025-04-15T21:31:42Z",
"published": "2025-04-15T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3522"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1955372"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-26"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-78P5-9W95-JC9J
Vulnerability from github – Published: 2025-11-18 09:30 – Updated: 2025-11-18 09:30SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.
{
"affected": [],
"aliases": [
"CVE-2025-40545"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T09:15:51Z",
"severity": "MODERATE"
},
"details": "SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.",
"id": "GHSA-78p5-9w95-jc9j",
"modified": "2025-11-18T09:30:52Z",
"published": "2025-11-18T09:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40545"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40545"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-78QJ-768G-464G
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2024-04-04 03:06GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
{
"affected": [],
"aliases": [
"CVE-2021-31879"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-29T05:15:00Z",
"severity": "MODERATE"
},
"details": "GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.",
"id": "GHSA-78qj-768g-464g",
"modified": "2024-04-04T03:06:46Z",
"published": "2022-05-24T17:49:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31879"
},
{
"type": "WEB",
"url": "https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210618-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-793H-885V-RXRH
Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2026-04-02 21:32The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.
{
"affected": [],
"aliases": [
"CVE-2025-24180"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T23:15:17Z",
"severity": "HIGH"
},
"details": "The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.",
"id": "GHSA-793h-885v-rxrh",
"modified": "2026-04-02T21:32:12Z",
"published": "2025-04-01T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24180"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122371"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122373"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122376"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122378"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122379"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/13"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/2"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/4"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-797H-QJWJ-28JC
Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2023-05-25 21:30mod_auth_openidc before version 2.4.0.1 is vulnerable to a None
{
"affected": [],
"aliases": [
"CVE-2019-14857"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-26T12:15:00Z",
"severity": "MODERATE"
},
"details": "mod_auth_openidc before version 2.4.0.1 is vulnerable to a None",
"id": "GHSA-797h-qjwj-28jc",
"modified": "2023-05-25T21:30:30Z",
"published": "2022-05-24T17:02:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14857"
},
{
"type": "WEB",
"url": "https://github.com/zmartzone/mod_auth_openidc/pull/451"
},
{
"type": "WEB",
"url": "https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75"
},
{
"type": "WEB",
"url": "https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14857"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/mod_auth_openidc/boy1Ba3Gdk4"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.