Possible redirection to external website after login success

[xuronno]

Hello, I have found unauthorized redirect on https://simpleanalytics.com/login page where I can lead the user to my sample phishing page. (It may lead to account takeover when the user got baited)

Impact

• Account takeover when the user login to the attacker website.

Proof of concept URL: https://simpleanalytics.com/login?next=https://evil.audaxss.repl.co

Sample executions:

How to execute the vulnerability:

1. Go to https://simpleanalytics.com/login?next=https://your-evil-site.com
2. Login your account.
3. After you login, you will be redirected to the attacker website (according to the parameter next value.)

[adriaandotcom]

Hey @heychrono. I appreciate you looking into this.

Although the way you subscribe the issue people can do this, but why not redirect customers directly to that "evil" website as an attacker?

You still would need the emails of our customers. So I guess this is just a regular phishing email. Not much we can do about that within our tool.

Do you agree?

[xuronno]

Hello, thank you for your reply. Regarding to the statement you’ve said that an attacker would need the email account of your customer, this bug is only available when the user uses the password option. On the other hand, this bug is a threat to the users who always use the password option, like me who doesn’t want to open my email too often.

[jibsaramnim]

I too wonder if there is any difference to just sending a direct link to a fake but real looking login page in an attempt to bait the customer into entering their login information.

The only way this could possibly be used for anything potentially nefarious would be to somehow convince a customer to open a link the perpetrator has provided that contains a different site in the next value, rather than the official link, right? And even then no personal/login data would be transferred, and you'd somehow have to convince them to enter their login information once again (for example).

Unless I'm missing something —which is entirely possible— that just seems like attempting to have someone log in to a fake but real looking login page with unnecessary extra steps.

There's probably a case that can be made to have the successful login redirect not support full domain names, but I'm having a hard time seeing actual security implications.

What do you think?

[xuronno]

The issue here is the attacker will use your official website/domain to redirect the user to their phishing website.

Why not just use the direct link to the phishing site? Because it's more convincing for the victim to login —because they see that they are in the official domain/website— after the victim login, the victim will be redirected to the attacker’s site that shows a login error for example —The victim will think he/she mispelled something— , so the victim will login again, after logging in again the victim will be redirected again to the official site.

What happened? When the user logins to the attacker’s site, the user login data will be saved to the attacker’s website.

[xuronno]

I would like to add some cases, this bug can be execute when the user is already logged in, the victim will be automatically redirected to the attacker's website.

Scenario: When the victim click the link https://simpleanalytics.com/login?next=%2f%2f%65%76%69%6c%2e%61%75%64%61%78%73%73%2e%72%65%70%6c%2e%63%6f, the victim will be automatically redirected to the attacker's website —Phishing page may have some convincing message or dialogs to trick the victim (e.g. "user session end, please login again to continue.", "Security check, please login to your account to continue.", etc.)— without logging in on the official website because the victim was already logged in.

[adriaandotcom]

It makes it slightly more trustworthy to redirect via our own website, but it needs way too much luck to really get user data. That's why we decided to not pay for this "exploit". I appreciate you looking into this, but it's a whole different ballgame from the other exploit. I hope you understand!

[xuronno]

It’s alright, I just want to make the website secure for the users’ safety. Could you just fix it, please? So that I’d feel I’m at ease. Thanks!

Just wanna add this, Hackers can also troll the users: https://simpleanalytics.com/login?next=%2f%2f%73%68%6f%72%74%75%72%6c%2e%61%74%2f%72%75%4d%53%54

[adriaandotcom]

Haha, nice one. Fixed!