Weakness (CWE)
CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
How to prevent it (6 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Use a list of approved URLs or domains to be used for redirection.
-
Architecture and Design
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
-
Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
-
Architecture and Design
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
-
Architecture and Design, Implementation
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-601
1,070 results · Clear filters · Feed
-
Medium 4.3
Open Redirect in Nextcloud Talk
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into openi…
-
Medium 6.1
SWG URL redirection vulnerability
A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious w…
-
Medium 6.1
Default redirect callback vulnerable to open redirects
next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to …
-
Medium 5.2
Automated Logic WebCtrl Server Open Redirection Vulnerability
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malic…
-
Medium 6.1
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.
-
Medium 5.4
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites.
-
Medium 6.1
Open redirect in wwbn/avideo
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
-
Medium 6.5
URL Confusion When Scheme Not Supplied in medialize/uri.js
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
-
Medium 5.4
Netegrity SiteMinder Login smpwservicescgi.exe redirect
A vulnerability was found in Netegrity SiteMinder up to 4.5.1 and classified as critical. Affected by this issue is the file /siteminderagent/pwcgi/smpwservicescgi.exe of the component Login. The manipulation of the argument target leads to an open redirect. …
-
Medium 6.1
Open Redirect in Flask-AppBuilder
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3…
-
Medium 4.7
Geolocation preview links can be set to arbitrary links in nextcloud talk
Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but…
-
Medium 4.3CVE-2022-0869 Scanner template
Multiple Open Redirect in nitely/spirit
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
-
Medium 6.1
Open Redirect in CPython that affects users of OpenStack Nova
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
-
Medium 5.4
Open Redirect
The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
-
Medium 4.7CVE-2022-0692 Scanner template
Open Redirect on Rudloff/alltube in rudloff/alltube
Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
-
Medium 5.4
Open redirect vulnerability in Jenkins GitLab Authentication Plugin
Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-…
-
Medium 4.3CVE-2022-0597 Scanner template
Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
-
Medium 4.3
Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
-
Medium 4.7
Open Redirect in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used t…
-
Medium 6.1CVE-2021-45328 Scanner template
Open redirect in Gitea
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
-
Medium 6.5
Unsafe handling of user-specified cookies in treq
treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a dictionary. Such cookies are not bound to a single domain,…
-
Medium 4.3
Cross-site Scripting and Open Redirect in plone.app.contenttypes
### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visito…
-
Medium 4.3
Cross-site Scripting and Open Redirect in Products.ATContentTypes
Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compro…
-
Medium 6.1
Open Redirect Vulnerability in QcalAgent
An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following…
-
Medium 6.1CVE-2021-44528 Scanner template
actionpack Open Redirect in Host Authorization Middleware
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to …
-
Medium 5.3
Open Redirect in digitalbazaar/forge
forge is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.8
Open redirect in shopware
Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no wo…
-
Medium 6.1
TCMAN GIM open redirect vulnerability
TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.
-
Medium 6.4
Open redirect in nextjs-auth0
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. User…
-
Medium 6.5
Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.5
Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.1CVE-2021-38000 Exploited
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remot…
KEV Nov 3, 2021 -
Medium 5.4
Cisco Webex Video Mesh Arbitrary Site Redirection Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP…
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilit…
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilit…
-
Medium 5.0
Open Redirect in firefly-iii/firefly-iii
firefly-iii is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.1
Open Redirect in ActionPack
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
-
Medium 6.1
URL Redirection to Untrusted Site ('Open Redirect') in fastify-static
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-st…
-
Medium 4.7
Cisco Orbital Open Redirect Vulnerability
A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage. This vulnerability is due to improper validation of URL paths in the web-based management interfac…
-
Medium 4.9
Open Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4