Open redirects – a vulnerability class no one but attackers cares about
stevetabernacle.github.io
Open redirects – a vulnerability class no one but attackers cares about
1–10 of 43 posts
Re: Open redirects – a vulnerability class no one but attackers cares about
#2Open redirects are also used for SEO spam to hijack domain authority and other nefarious purposes.
It's silly that these big tech companies won't fix them.
Re: Open redirects – a vulnerability class no one but attackers cares about
#3A decade ago people were using Google redirects to lure people into visiting shock sites.
Back then, it seemed reasonable to not consider this a real security flaw. Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously.
At the very least, either host the redirect on a domain that is clearly distinct from the domain users log into, or ignore the destination parameter if the referrer is not a trusted source.
Now I'm wondering if this is also a potential vector for DDoS attacks against a third party. Widely distribute links "to a cute puppy on Instagram" that redirect to a URL that triggers a resource-intensive search operation on the victim's server? (Bonus points if the redirect points to a page that loads an actual cute puppy in one frame, and targets the victim with a 1-pixel frame.)
It sounds like a stretch, but I can't rule the possibility out. Even if it can't be used to launch a DDoS, I could see it being used for advertising fraud.
Re: Open redirects – a vulnerability class no one but attackers cares about
#4Open redirects are also used to prevent referrers from propagating through. In that sense, they're very useful for anonymisation.
Re: Open redirects – a vulnerability class no one but attackers cares about
#5I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe.
Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I think the severity:low the "good" (unconstrained, straightforward links, persistent, across all browsers) ones get is well measured.
I see open redirects as sort of the archetype of the "t-shirt vulnerability" --- the one the bug bounty sends you swag, instead of cash, for finding.
Re: Open redirects – a vulnerability class no one but attackers cares about
#6I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…
I suppose there's some potential for SSRF abuse, although it's easy to argue the fault lies elsewhere.
Re: Open redirects – a vulnerability class no one but attackers cares about
#7A decade ago people were using Google redirects to lure people into visiting shock sites. Back then, it seemed reasonable to not consider this a real security flaw. Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously. At the very least, either host the redirect on a domain that is clearly distinct from the domain users log into, or ignore the destina…
> Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously.
Not sure I follow - is the idea to redirect from google.com to an attacker's site that spoofs the Google login page? I think we'll get more mileage out of solving that with origin-aware authentication mechanisms (password managers, U2F, WebAuthn, etc.) and perhaps address bars that show the eTLD+1 instead of / more prominently than the full URL. Phishing is already a problem even without open redirects.
> Widely distribute links "to a cute puppy on Instagram" that redirect to a URL that triggers a resource-intensive search operation on the victim's server?
Keep in mind that unrelated web pages can send GET requests to each other by just using an image tag, so if your website has a resource-intensive search delivered over GET and no automation to detect suspicious behavior and spikes in certain types of requests, you're already vulnerable to this via e.g. someone submitting an interesting blog page to HN that loads youe search page as a resource. Either make it POST or add some HTTP-level DDoS protection a la Cloudflare.
Same with advertising fraud - ad clicks should be POSTs. (Open POST redirects do seem more dangerous but are probably rare.)
Re: Open redirects – a vulnerability class no one but attackers cares about
#8I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…
I suppose there's some potential for SSRF abuse, although it's easy to argue the fault lies elsewhere.
Right, and also internal CSRF is in fact an underrated vulnerability.
Re: Open redirects – a vulnerability class no one but attackers cares about
#9I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…
Author here. Thanks for your comment. I think you have a valid point about users clicking anything. However I would only say that's the case if you send around 20 phishing mails. In a targeted attack you want to send one or two phishing mails and you wanna maximize your chances of success to avoid a reaction from the blue team.
I agree that the impact is low compared to other vulnerabilities. It is definitely the case that you get a t-shirt (at best) for it. Though, my point is that they could be critical for the users, not for the website itself. An attacker that don't really care about the vulnerable website can still exploit the trust in the vulnerable website to perform attacks on the user he is interested in (e.g. hash stealing or malicious redirects). In fact, I believe malicious redirects is a really common payload of XSS flaws.
Re: Open redirects – a vulnerability class no one but attackers cares about
#10Surprised the author doesn't mention oauth - open redirects are the achilles' heel of oauth flows and allow for full account takeovers. It is very common.