CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.1)  
Search by ID:

CWE-601: URL Redirection to Untrusted Site (aka 'Open Redirect')

Individual Definition in a New Window
URL Redirection to Untrusted Site (aka 'Open Redirect')
Status: Draft
Weakness ID: 601 (Weakness Variant)
Description
Summary

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Extended Description

An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

Alternate Terms
Open Redirect
Cross-site Redirect
Cross-domain Redirect
Likelihood of Exploit

Low

Detection Factors

Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects.

Potential Mitigations

Assume that all user inputs are malicious. Perform input validation of all user requests.

Use a whitelist of approved URLs or domains to redirect to.

Provide an intermediate disclaimer page that provides the user with a clear warning that they are leaving your site. Implement a long timeout before the redirect occurs, or force the user to click on the link.

Observed Examples
ReferenceDescription
URL parameter loads the URL into a frame and causes it to appear to be part of a valid page.
Open redirect vulnerability in the software allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the proper parameter.
An open redirect vulnerability in the search script in the software allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL as a parameter to the proper function.
Background Details

Phishing is a general term for deceptive attempts to coerce private information from users that will be used for identity theft.

References
Craig A. Shue, Andrew J. Kalafut and Minaxi Gupta. "Exploitable Redirects on the Web: Identification, Prevalence, and Defense". <http://www.cs.indiana.edu/cgi-pub/cshue/research/woot08.pdf>.
Russ McRee. "Open redirect vulnerabilities: definition and prevention". Page 43. Issue 17. (IN)SECURE. July 2008. <http://www.net-security.org/dl/insecure/INSECURE-Mag-17.pdf>.
Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class610Externally Controlled Reference to a Resource in Another Sphere
Research Concepts (primary)1000
ChildOfWeakness ClassWeakness ClassWeakness Class20Insufficient Input Validation
Development Concepts (primary)699
ChildOfCategoryCategory442Web Problems
Development Concepts699
Taxonomy Mappings
Mapped Taxonomy Name
Anonymous Tool Vendor (under NDA)
Time of Introduction
* Architecture and Design
* Implementation
Content History
Submissions
Anonymous Tool Vendor (under NDA). (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Potential_Mitigations, Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Alternate_Terms, Background_Details, Description, Detection_Factors, Likelihood_of_Exploit, Name, Relationships, Observed_Example, Taxonomy_Mappings
CWE Content Team. MITRE. 2008-10-03. (Internal)
updated References and Observed_Examples
CWE Content Team. MITRE. 2008-10-14. (Internal)
updated Alternate_Terms, Observed_Examples, References
Previous Entry Names
* Unsafe URL Redirection (changed 2008-04-11)
* URL Redirection to Untrusted Site (changed 2008-09-09)
Page Last Updated: November 24, 2008