1349
The user sees the link pointing to the original trusted site (example.com) and does not realize the
redirection that could take place.
Example 2:
The following code is a Java servlet that will receive a GET request with a url parameter in the
request to redirect the browser to the address specified in the url parameter. The servlet will
retrieve the url parameter value from the request and send a response to redirect the browser to
the url address.
Example Language: Java (Bad)
public class RedirectServlet extends HttpServlet {
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
{
String query = request.getQueryString();
if (query.contains("url")) {
String url = request.getParameter("url");
response.sendRedirect(url);
}
}
}
The problem with this Java servlet code is that an attacker could use the RedirectServlet as part
of an e-mail phishing scam to redirect users to a malicious site. An attacker could send an HTML
formatted e-mail directing the user to log into their account by including in the e-mail the following
link:
Example Language: HTML (Attack)
<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>
The user may assume that the link is safe since the URL starts with their trusted bank,
bank.example.com. However, the user will then be redirected to the attacker's web site
(attacker.example.net) which the attacker may have made to appear very similar to
bank.example.com. The user may then unwittingly enter credentials into the attacker's web page
and compromise their bank account. A Java servlet should never redirect a user to a URL without
verifying that the redirect address is a trusted site.
Observed Examples
Reference Description
CVE-2005-4206 URL parameter loads the URL into a frame and causes it to appear to be part
of a valid page.
https://www.cve.org/CVERecord?id=CVE-2005-4206
CVE-2008-2951 An open redirect vulnerability in the search script in the software allows remote
attackers to redirect users to arbitrary web sites and conduct phishing attacks
via a URL as a parameter to the proper function.
https://www.cve.org/CVERecord?id=CVE-2008-2951
CVE-2008-2052 Open redirect vulnerability in the software allows remote attackers to redirect
users to arbitrary web sites and conduct phishing attacks via a URL in the
proper parameter.
https://www.cve.org/CVERecord?id=CVE-2008-2052
CVE-2020-11053 Chain: Go-based Oauth2 reverse proxy can send the authenticated user to
another site at the end of the authentication flow. A redirect URL with HTMLencoded
whitespace characters can bypass the validation (CWE-1289) to
redirect to a malicious site (CWE-601)
https://www.cve.org/CVERecord?id=CVE-2020-11053
MemberOf Relationships
CWE Version 4.14
CWE-602: Client-Side Enforcement of Server-Side Security
CWE-602: Client-Side Enforcement of Server-Side Security