Unvalidated Redirects & Forwards Rick Stroud 28 July 2016 CSCE 548 Student Presentation

Agenda By the conclusion of this presentation you will be able to answer the following 4 questions concerning Unvalidated Redirects & Forwards Q1) What Is It? Q2) What Is The Risk? Q3) How To Prevent It? Q4) How to Detect It?

What is a Redirect & Forward? Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages1. response.sendRedirect("http://www.SomeSite.com"); www.SomeSite.com/RedirectMe.jsp?Destination=AnotherSite.com #10 on OWASP Top 10 Vulnerabilities 1https://www.owasp.org/index.php/Top_10_2013-Top_10

Are All Redirect & Forwards Bad? There are legitimate reasons why an application may need to redirect a user For example, after authentication some websites take users to their personally defined home page If you have ever visited a website on a mobile device and been automatically taken to the mobile version of the site you have likely encountered a redirect or forward Redirects & Forwards are a key part of internet & email marketing

What Google Says “We recognize that the address bar is the only reliable security indicator in modern browsers; consequently, we hold that the usability and security benefits of a small number of well-designed and closely monitored redirectors outweigh their true risks.”2,3 2https://www.google.com/about/appsecurity/reward-program/ 3https://www.credera.com/blog/technology-insights/java/top-10-web-security-risks-unvalidated-redirects-forwards-10/

Example – Non Malicious

When Are Redirect & Forwards Bad? When the destination of the redirect & forward are vulnerable to tampering This includes redirecting to user supplied destinations Any time destination of redirection cannot be validated, risk exists

When Can User Input be Trusted? never

What is the Risk? Risk is essentially, Cross-Site Scripting This has been well covered already by other presentations Anytime the destination address can be modified the user can be taken to a site with malicious intent Commonly used in phishing attacks

How to Prevent Risk? Simply avoid using redirects and forwards. If used, do not allow the url as user input for the destination. At a minimum, have a method to validate URL. If user input is required, make sure the value is valid, appropriate within the context of the application, and the user is authorized to access the destination Rather than using user input directly, map limited set of possible input values to a domain of allowed destination URLs. Store list of trusted URLs securely, not in source code. Notify all users when a redirect happens, especially if they are leaving your site, and require click confirmation. 4https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet

Example of a valid redirect? To prevent tampering, encode parameters

How To Detect? In your own code, standard code review. Tools - A redirect normally returns an HTTP code in the 300-307 range, www.redirect-checker.org

What OWASP Has To Say5 Exploitability – Average Prevalence – Uncommon Detectability – Easy Technical Impact – Moderate Business Impact – Varies, application specific, may undermine trust 5https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards

Bonus Example – Email Newsletter Take the newsletter below & the unsubscribe link

Example – Email Newsletter The Unsubscribe link goes to http://eepurl.us7.list-manage.com/track/click? u=aff97178dc9be0c5fe5c1355d& id=dae1130494& e=e80a689799 And Redirects the user to the link below http://yahoo.us7.list-manage1.com/subscribe? id=4782b1a8b6 The parameters in the redirect encode both the destination to redirect the user to and the identity of the recipient.

Microsoft Engineering Excellence Questions? Microsoft Confidential

Reference Summary 1 https://www.owasp.org/index.php/Top_10_2013-Top_10 2 https://www.google.com/about/appsecurity/reward-program/ 3 https://www.credera.com/blog/technology-insights/java/top-10-web-security-risks-unvalidated-redirects-forwards-10/ 4https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet 5https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards