CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.4)  

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Individual Definition in a New Window
URL Redirection to Untrusted Site ('Open Redirect')
Status: Draft
Weakness ID: 601 (Weakness Variant)
+ Description
Summary

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Extended Description

An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.

+ Alternate Terms
Open Redirect
Cross-site Redirect
Cross-domain Redirect
+ Time of Introduction
* Architecture and Design
* Implementation
+ Likelihood of Exploit

Low

+ Detection Factors

Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects.

+ Observed Examples
ReferenceDescription
URL parameter loads the URL into a frame and causes it to appear to be part of a valid page.
Open redirect vulnerability in the software allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the proper parameter.
An open redirect vulnerability in the search script in the software allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL as a parameter to the proper function.
+ Potential Mitigations

Assume that all user inputs are malicious. Perform input validation of all user requests.

Use a whitelist of approved URLs or domains to redirect to.

Provide an intermediate disclaimer page that provides the user with a clear warning that they are leaving your site. Implement a long timeout before the redirect occurs, or force the user to click on the link.

+ Background Details

Phishing is a general term for deceptive attempts to coerce private information from users that will be used for identity theft.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class610Externally Controlled Reference to a Resource in Another Sphere
Research Concepts (primary)1000
ChildOfWeakness ClassWeakness ClassWeakness Class20Improper Input Validation
Development Concepts (primary)699
ChildOfCategoryCategory442Web Problems
Development Concepts699
ChildOfCategoryCategory722OWASP Top Ten 2004 Category A1 - Unvalidated Input
Weaknesses in OWASP Top Ten (2004) (primary)711
+ Taxonomy Mappings
Mapped Taxonomy Name
Anonymous Tool Vendor (under NDA)
+ References
Craig A. Shue, Andrew J. Kalafut and Minaxi Gupta. "Exploitable Redirects on the Web: Identification, Prevalence, and Defense". <http://www.cs.indiana.edu/cgi-pub/cshue/research/woot08.pdf>.
Russ McRee. "Open redirect vulnerabilities: definition and prevention". Page 43. Issue 17. (IN)SECURE. July 2008. <http://www.net-security.org/dl/insecure/INSECURE-Mag-17.pdf>.
+ Content History
Submissions
Anonymous Tool Vendor (under NDA). (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Potential_Mitigations, Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Alternate_Terms, Background_Details, Description, Detection_Factors, Likelihood_of_Exploit, Name, Relationships, Observed_Example, Taxonomy_Mappings
CWE Content Team. MITRE. 2008-10-03. (Internal)
updated References and Observed_Examples
CWE Content Team. MITRE. 2008-10-14. (Internal)
updated Alternate_Terms, Observed_Examples, References
CWE Content Team. MITRE. 2009-03-10. (Internal)
updated Relationships
CWE Content Team. MITRE. 2009-05-27. (Internal)
updated Name
Previous Entry Names
* Unsafe URL Redirection (changed 2008-04-11)
* URL Redirection to Untrusted Site (changed 2008-09-09)
* URL Redirection to Untrusted Site (aka 'Open Redirect') (changed 2009-05-27)
Page Last Updated: May 26, 2009