URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect.

An open redirect vulnerability occurs when an application takes user input and uses it to redirect the user to a different URL. Attackers can exploit this to redirect users to malicious sites.

보급률

보통

3개 언어 지원

영향

보통

검토 권장

예방

문서화됨

4개의 수정 예시

2 예방

이 취약점을 수정하는 방법

4개의 Shoulder 탐지 규칙을 기반으로 한 Open Redirect 예방 전략.

🐹 Go 모두 보기 Go 자세히 →

Open Redirect MEDIUM

Validate redirect URLs against an allowlist of trusted domains

+18 -5 go

  package main
  
- import "net/http"
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     target := r.URL.Query().Get("redirect")
-     // Vulnerable: redirect to user-controlled URL
+ import (
+     "net/http"
+     "net/url"
+ )
+ 
+ var allowedHosts = map[string]bool{
+     "example.com":     true,
+     "app.example.com": true,
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     target := r.URL.Query().Get("redirect")
+     u, err := url.Parse(target)
+     if err != nil || (u.Host != "" && !allowedHosts[u.Host]) {
+         http.Error(w, "Invalid redirect URL", http.StatusBadRequest)
+         return
+     }
+     // Safe: only allows relative paths or allowed domains
      http.Redirect(w, r, target, http.StatusFound)
  }

🟨 JavaScript 모두 보기 JavaScript 자세히 →

Next.js Open Redirect MEDIUM

Validate redirect targets against an allowlist of permitted paths

+8 -5 javascript

- export function middleware(request) {
-   const redirectUrl = request.nextUrl.searchParams.get('redirect');
-   if (redirectUrl) {
-     return NextResponse.redirect(redirectUrl);
-   }
+ const ALLOWED_PATHS = ['/login', '/dashboard', '/profile'];
+ 
+ export function middleware(request) {
+   const redirect = request.nextUrl.searchParams.get('redirect');
+   if (redirect && ALLOWED_PATHS.includes(redirect)) {
+     return NextResponse.redirect(new URL(redirect, request.url));
+   }
+   return NextResponse.redirect(new URL('/', request.url));
  }

Open Redirect via Untrusted URLs MEDIUM

Validate redirect URLs against an allowlist or enforce relative paths

+9 -3 javascript

  const express = require('express');
  const app = express();
  
- app.get('/redirect', (req, res) => {
-   const url = req.query.url;
-   res.redirect(url);
+ const ALLOWED_REDIRECTS = ['/home', '/dashboard', '/profile'];
+ 
+ app.get('/redirect', (req, res) => {
+   const url = req.query.url;
+   if (ALLOWED_REDIRECTS.includes(url) || url.startsWith('/')) {
+     res.redirect(url);
+   } else {
+     res.redirect('/home');
+   }
  });

🐍 Python 모두 보기 Python 자세히 →

Open Redirect MEDIUM

Validate redirect URLs against a domain allowlist or use relative paths

+10 -4 python

  from flask import request, redirect
- 
- @app.route('/goto')
- def goto():
-     url = request.args.get('url')
+ from urllib.parse import urlparse
+ 
+ ALLOWED_DOMAINS = {"myapp.com", "www.myapp.com"}
+ 
+ @app.route('/goto')
+ def goto():
+     url = request.args.get('url', '/')
+     parsed = urlparse(url)
+     if parsed.netloc and parsed.netloc not in ALLOWED_DOMAINS:
+         url = '/'
      return redirect(url)

3 탐지

코드에서 취약점 찾기

Shoulder를 사용하여 코드에서 URL Redirection to Untrusted Site ('Open Redirect') 패턴을 스캔하세요. 4 규칙.

터미널

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=601

# Or scan entire project
npx @shoulderdev/cli trust .

탐지 규칙 (4)

🟨 Javascript 2 rules

Next.js Open Redirect MEDIUM

Detects user-controlled input flowing into redirect targets in Next.js middleware.

Open Redirect via Untrusted URLs MEDIUM

Detects user input flowing into redirect functions without URL validation.

🔷 Typescript 2 rules

Next.js Open Redirect MEDIUM

Detects user-controlled input flowing into redirect targets in Next.js middleware.

Open Redirect via Untrusted URLs MEDIUM

Detects user input flowing into redirect functions without URL validation.

🐹 Go 1 rules

Open Redirect MEDIUM

User-controlled input used in http.Redirect without URL validation.

🐍 Python 1 rules

Open Redirect MEDIUM

Detects unvalidated redirects using user input.

4 경고 신호

코드 리뷰에서 주의할 점

이 패턴은 잠재적인 URL Redirection to Untrusted Site ('Open Redirect') 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.

🟡

User input flows to redirect without validation go-open-redirect

🟡

user-controlled input flowing into redirect targets in Next javascript-nextjs-open-redirect

🟡

user input flowing into redirect functions without URL validation javascript-open-redirect

🟡

unvalidated redirects using user input python-open-redirect

🔍

코드베이스를 스캔하세요: URL Redirection to Untrusted Site ('Open Redirect')

Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.

npx shoulder trust 모든 규칙 보기