|
|
Status: Draft Weakness ID: 601 (Weakness Variant)Description Summary A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Extended Description An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Alternate Terms Open Redirect Cross-site Redirect Cross-domain Redirect Likelihood of Exploit Low Detection Factors Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects. Potential Mitigations Assume that all user inputs are malicious. Perform input validation of all user requests. Use a whitelist of approved URLs or domains to redirect to. Provide an intermediate disclaimer page that provides the user with a clear warning that they are leaving your site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Observed Examples
Background Details Phishing is a general term for deceptive attempts to coerce private information from users that will be used for identity theft. References Craig A. Shue, Andrew J. Kalafut
and Minaxi Gupta. "Exploitable Redirects on the Web: Identification, Prevalence,
and Defense". <http:/ Russ McRee. "Open redirect vulnerabilities: definition and prevention". Page 43. Issue 17. (IN)SECURE. July 2008. <http:/ Relationships
Taxonomy Mappings
Time of Introduction  Architecture and Design ImplementationContent History Submissions Anonymous Tool Vendor (under NDA). (Externally Mined) Modifications Eric Dalci. Cigital. 2008-07-01. (External) updated Potential_Mitigations,
Time_of_Introduction CWE Content Team. MITRE. 2008-09-08. (Internal) updated Alternate_Terms, Background_Details, Description,
Detection_Factors, Likelihood_of_Exploit, Name, Relationships,
Observed_Example, Taxonomy_Mappings CWE Content Team. MITRE. 2008-10-03. (Internal) updated References and
Observed_Examples CWE Content Team. MITRE. 2008-10-14. (Internal) updated Alternate_Terms, Observed_Examples, References Previous Entry Names Unsafe URL Redirection (changed 2008-04-11) URL Redirection to Untrusted
Site (changed 2008-09-09) |
|
|
|||
