1. Unvalidated Redirects & Forwards
Rick Stroud
28 July 2016
CSCE 548 Student Presentation

2. Agenda
By the conclusion of this presentation you will be able to answer the following 4 questions concerning Unvalidated Redirects & Forwards Q1) What Is It? Q2) What Is The Risk? Q3) How To Prevent It? Q4) How to Detect It?

3. What is a Redirect & Forward?
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages1.
response.sendRedirect("
#10 on OWASP Top 10 Vulnerabilities
1https://

4. Are All Redirect & Forwards Bad?
There are legitimate reasons why an application may need to redirect a user
For example, after authentication some websites take users to their personally defined home page
If you have ever visited a website on a mobile device and been automatically taken to the mobile version of the site you have likely encountered a redirect or forward
Redirects & Forwards are a key part of internet & marketing

5. What Google Says
“We recognize that the address bar is the only reliable security indicator in modern browsers; consequently, we hold that the usability and security benefits of a small number of well-designed and closely monitored redirectors outweigh their true risks.”2,3
2https://
3https://

6. Example – Non Malicious

7. When Are Redirect & Forwards Bad?
When the destination of the redirect & forward are vulnerable to tampering
This includes redirecting to user supplied destinations
Any time destination of redirection cannot be validated, risk exists

8. When Can User Input be Trusted?
never

9. What is the Risk? Risk is essentially, Cross-Site Scripting
This has been well covered already by other presentations
Anytime the destination address can be modified the user can be taken to a site with malicious intent
Commonly used in phishing attacks

10. How to Prevent Risk? Simply avoid using redirects and forwards.
If used, do not allow the url as user input for the destination. At a minimum, have a method to validate URL.
If user input is required, make sure the value is valid, appropriate within the context of the application, and the user is authorized to access the destination
Rather than using user input directly, map limited set of possible input values to a domain of allowed destination URLs.
Store list of trusted URLs securely, not in source code.
Notify all users when a redirect happens, especially if they are leaving your site, and require click confirmation.
4https://

11. Example of a valid redirect?
To prevent tampering, encode parameters

12. How To Detect? In your own code, standard code review.
Tools - A redirect normally returns an HTTP code in the range,

13. What OWASP Has To Say5 Exploitability – Average Prevalence – Uncommon
Detectability – Easy
Technical Impact – Moderate
Business Impact – Varies, application specific, may undermine trust
5https://

14. Bonus Example – Email Newsletter
Take the newsletter below & the unsubscribe link

15. Example – Email Newsletter
The Unsubscribe link goes to
u=aff97178dc9be0c5fe5c1355d&
id=dae &
e=e80a689799
And Redirects the user to the link below
id=4782b1a8b6
The parameters in the redirect encode both the destination to redirect the user to and the identity of the recipient.

16. Microsoft Engineering Excellence
Questions?
Microsoft Confidential

17. Reference Summary
https:// 5https://