5 ms·
This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards".
by tednaleid 17y ago
This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards".
http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec...
Every web app developer should review these vulnerabilities before releasing their code to the world.
- xtacy 17y agoInteresting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect: site.com/redirect?l=<url>&h=hash(secret,url)
- alex1 17y agoFacebook also presents you with a warning page before redirecting you: http://www.facebook.com/l.php?u=http%3A%2F%2Fnews.ycombinator.com%2F&h=7b1c5f3088c6ed5de8b5e72d41bf3f3e http://www.facebook.com/l.php?u=http%3A%2F%2Fnews.ycombinato...
- mike-cardwell 17y agoI do the same on my own website. I built a redirector using Apache mod_rewrite, and then secured it using a token and some mod_security configuration. See here: https://secure.grepular.com/Secure_URL_Redirects_using_Apache_ModRewrite_and_ModSecurity https://secure.grepular.com/Secure_URL_Redirects_using_Apach...
- xtacy 17y agoIs the primary motivation behind redirection to another website to track clicks? In situations like Facebook, a redirect effectively changes the REFERRER header so that it doesn't leak any information (about the origin of the request, like: facebook.com/profile.php?id)
- pbhjpbhj 17y agoI'd imagine you are right, primarily click-tracking. Secondarily linkjuice control I expect.
- exit 17y agothat doesn't seem to solve it. the youtube redirect also has a signature, but generating a signed link is trivial.
- eli 17y agoGood point. Clearly there's a pretty serious problem with however they're creating those hashes.
- code_duck 17y agoAha, that's a good idea. We have an open redirect on our site that I've been looking at fixing, but while verifying all the possible links against a whitelist would work, it would be a pain.
- andrewcooke 17y agoit's better to call it a hmac - http://en.wikipedia.org/wiki/HMAC http://en.wikipedia.org/wiki/HMAC - since reinventing them using hashes can lead to weaknesses (see "design principles" on that page).