1346
Open Redirect :
Cross-site Redirect :
Cross-domain Redirect :
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that
contains malware which may then compromise the user's
machine. This will expose the user to extensive risk and
the user's interaction with the web server may also be
compromised if the malware conducts keylogging or
other attacks that steal credentials, personally identifiable
information (PII), or other important data.
Access Control
Confidentiality
Other
Bypass Protection Mechanism
Gain Privileges or Assume Identity
Other
The user may be subjected to phishing attacks by being
redirected to an untrusted page. The phishing attack may
point to an attacker controlled web page that appears to be
a trusted web site. The phishers may then steal the user's
credentials and then use these credentials to access the
legitimate web site.
Detection Methods
Manual Static Analysis
Since this weakness does not typically appear frequently within a single software package,
manual white box techniques may be able to provide sufficient code coverage and reduction
of false positives if all potentially-vulnerable operations can be assessed within limited time
constraints.
Effectiveness = High
Automated Dynamic Analysis
Automated black box tools that supply URLs to every input may be able to spot Location header
modifications, but test case coverage is a factor, and custom redirects may not be detected.
Automated Static Analysis
Automated static analysis tools may not be able to determine whether input influences the
beginning of a URL, which is important for reducing false positives.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Automated Static Analysis - Binary or Bytecode
CWE Version 4.14
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')