Description

Open redirects occur when a website redirects users to a URL specified via a parameter without sufficient validation. This can allow attackers to manipulate the parameter to redirect users to malicious sites. This post will discuss the mechanisms of open redirects, their risks, and how to prevent them..

Websites often redirect users automatically, especially in scenarios where unauthenticated users try to access restricted pages. For instance, a user trying to access https://example.com/dashboard might be redirected to https://example.com/login to log in first. To return the user to their intended page after logging in, the site might use a URL parameter to remember the original location, such as:

https://example.com/login?redirect=https://example.com/dashboard

Open Redirect Attack

An attacker can exploit this mechanism by tricking users into visiting a malicious site via a legitimate-looking URL:

https://example.com/login?redirect=https://attacker.com

Users might click this link, believing it leads to a legitimate page, only to be redirected to a malicious site, enabling attackers to perform phishing attacks.

Referer-Based Redirect

Some sites use the Referer HTTP header to determine the original location of the user. An attacker can exploit this by creating a page that sets the Referer header to their malicious site, causing the user to be redirected there after visiting the legitimate site. An example HTML might look like:

<html>
<a href="https://example.com/login">Click here to log in to example.com</a>
</html>

When a user clicks the link, the href attribute specifies the redirect target.

Risks

Open redirects can lead to several security issues:
Phishing Attacks: Users are tricked into entering their credentials on a malicious site.
Loss of Trust: Users may lose trust in the legitimate site if they fall victim to an open redirect attack.
Escalation of Other Attacks: Open redirects can be used in combination with other vulnerabilities to escalate attacks.

Mitigation

URL Validation To prevent open redirects, the server must validate redirect URLs to ensure they are legitimate. This can be done using blocklists or allowlists:
Blocklist: The server checks the redirect URL for known malicious indicators or special characters and blocks those requests.
Allowlist: The server ensures the redirect URL matches a list of allowed hosts. If it does, the redirect proceeds; otherwise, it is blocked.
—