search

Eye4web / E4WZfcUserRedirectUrl

Change the redirect behaviour of ZfcUser to use URL's insteaf or routes in the redirect param
BSD 3-Clause "New" or "Revised" License
1 stars 7 forks source link

Reject redirect on // prefix #3

Closed papayasoft closed 2 years ago

papayasoft commented 5 years ago

It is possible to bypass the whitelist by using a redirect with a schema-less url:

?redirect=//nonwhitelisteddomain.com/path/to/page

which opens up a possible phishing attack via Unvalidated Redirect:

https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet

This tweak closes the whitelist bypass while still allowing root-absolute destinations.