https://github.com/qeeqbox/open-redirect

A threat actor may send a malicious redirection request for a vulnerable target to a victim; the victim gets redirected to a malicious website that downloads an executable file
https://github.com/qeeqbox/open-redirect

infosecsimplified open qeeqbox redirect vulnerability

Last synced: 2 days ago
JSON representation

A threat actor may send a malicious redirection request for a vulnerable target to a victim; the victim gets redirected to a malicious website that downloads an executable file

• Host: GitHub
• URL: https://github.com/qeeqbox/open-redirect
• Owner: qeeqbox
• License: agpl-3.0
• Created: 2023-06-18T21:49:06.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2024-01-29T00:59:14.000Z (10 months ago)
• Last Synced: 2024-05-01T11:27:24.337Z (7 months ago)
• Topics: infosecsimplified, open, qeeqbox, redirect, vulnerability
• Homepage:
• Size: 119 KB
• Stars: 3
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
 


A threat actor may send a malicious redirection request for a vulnerable target to a victim; the victim gets redirected to a malicious website that downloads an executable file

## Example #1

1. Threat actor crafts an email with a malicious redirection request for a vulnerable target and sends the email to a victim

2. The victim clicks on the email and sends the request to the vulnerable target

3. The target processes the malicious redirection request back to the victim

4. The victim's browser redirects the user to a malicious website

## Code

#### Target-Logic 

```js

app.post("/weclome", (request, response) => {

    if (request.redirect){

        res.redirect(req.query.redirect);

    } else {

        res.redirect("/")

    }

});

```

#### Target-In

```

?redirect=test.com

```

## Impact

Medium

## Names

- Open Redirect

## Risk

- Redirect users

## Redemption

- Input validation

## Require

- Social Engineering

## ID

cea84b63-1552-47ad-a160-503f1c913390

## References

- [wiki](https://en.wikipedia.org/wiki/Open_redirect)