Open Redirect

MediumWeb Application SecurityA01:2021 – Broken Access Control

An application accepts untrusted user input for redirect destinations without validation, allowing attackers to redirect victims to malicious sites for phishing or credential theft.

Immediate Response

1Identify and disable all endpoints accepting unvalidated redirect parameters.
2Audit access logs for redirect abuse and identify affected users.
3Deploy WAF rules to block known malicious redirect destinations.
4Notify users who may have been redirected to phishing sites.

All playbooks

1Validate redirect destinations against an allowlist of trusted internal paths and domains.
2Reject any redirect URL containing protocol schemes, double slashes, or encoded characters.
3Use relative paths instead of absolute URLs for all internal redirects.
4Implement a confirmation page warning users before navigating to external sites.

Long-term Prevention

1Add open redirect test cases to automated DAST scans in CI/CD.
2Use SAST rules to detect unsafe redirect constructions using user input.
3Enforce strict Content-Security-Policy frame-ancestors and navigate-to directives.
4Conduct regular code reviews focusing on all redirect and forwarding logic.

Attack vectors

URL parameters such as ?redirect=, ?next=, or ?return_to= accepting arbitrary external URLs
OAuth or SSO callback URLs manipulated to point to attacker-controlled domains
JavaScript-based redirects using window.location with user-controlled values
HTTP header-based redirects using unvalidated Location or Referer headers

Indicators of compromise

Redirect parameters in access logs pointing to external or suspicious domains
Phishing complaints from users arriving at malicious sites via application URLs
OAuth callback requests with unexpected state or redirect_uri values
Referrer headers showing traffic flowing from the application to unknown external sites

Tooling

OWASP ZAPBurp SuiteNucleiSemgrep