Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CWE-601: URL Redirection to Untrusted Site ('Open Redirect') #36

Closed
hackza0101 opened this issue Sep 28, 2021 · 1 comment
Closed

CWE-601: URL Redirection to Untrusted Site ('Open Redirect') #36

hackza0101 opened this issue Sep 28, 2021 · 1 comment
Labels
type: bug something isn't working
Milestone

Comments

@hackza0101
Copy link

The application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
`

Log off

def destroy
  remove_session

  # do we want to redirect externally?
  path = params.permit(:continue)[:continue] || '/'

  if path.include?("://")
      authority = current_authority
      uri = Addressable::URI.parse(path)

      if uri.domain == authority.domain
        path = "#{uri.request_uri}#{uri.fragment ? "##{uri.fragment}" : nil}"
      else
        path = authority.logout_url
        if path.include?("continue=")
          path = URI.decode_www_form_component(path.split("continue=", 2)[-1])
        end
      end
  end

  redirect_to path
end

`

oredirect

Payload: https:///auth/logout?continue=//<external_domain>

@hackza0101 hackza0101 added the type: bug something isn't working label Sep 28, 2021
@hackza0101
Copy link
Author

The fix 395d1c5 also vulnerable to open redirection.

For the payload "https://test.com.au/auth/logout?continue=.attacker.com" ,
the user will be redirected to "https://test.com.au.attacker.com"

stakach added a commit that referenced this issue Sep 29, 2021
@jeremyw24 jeremyw24 added this to the 1.29.10.0 milestone Sep 29, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: bug something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants