Unvalidated Redirects and Forwards

Most web applications on the internet frequently redirect and forward users to other pages or other external websites. However, without validating the credibility of those pages, hackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and Business Impacts of this flaw with the help of simple diagram.

Example

Some classic examples of Unvalidated Redirects and Forwards are as given −

• Let us say the application has a page - redirect.jsp, which takes a parameter redirectrul. The hacker adds a malicious URL that redirects users which performs phishing/installs malware.

http://www.mywebapp.com/redirect.jsp?redirectrul=hacker.com

• All web application used to forward users to different parts of the site. In order to achieve the same, some pages use a parameter to indicate where the user should be redirected if an operation is successful. The attacker crafts an URL that passes the application's access control check and then forwards the attacker to administrative functionality for which the attacker has not got the access.

http://www.mywebapp.com/checkstatus.jsp?fwd=appadmin.jsp

Preventive Mechanisms

• It is better to avoid using redirects and forwards.

• If it is unavoidable, then it should be done without involving user parameters in redirecting the destination.