URL Redirector Abuse
Archived post from 2009, recovered from my old blog. The technology described here is probably out of date. Original at the Internet Archive.
Problem description
An application running on WebSphere Application Server implements a logic that allows redirecting browser to an arbitrary URL address passed as an request parameter:
Application uses those request to redirect user to other pages within the site but it does not validate whether the URL specified is actually internal or an external.
Facts
It is a known security issue, called sometimes Open redirect or URL Redirector Abuse and it can be used in phishing attacks to get users to visit malicious sites without realizing it.
Since the traffic is routed to the application server through IBM HTTP Server which is based on Apache Server there is a chance to use mod_rewrite module to intercept and block malicious requests.
We need to block requests matching the following criteria:
– query string contains redirectURL parameter
– value of redirectURL parameter does not start with / (I assume that relative URL are safe)
– value of redirectURL parameter does not start with http://myhost (absolute URL but within my site are safe)
Solution
To implement described rules, the following configuration has to be added to httpd.conf file of HTTP server:
RewriteEngine On
RewriteCond %{QUERY_STRING} redirectURL\=
RewriteCond %{QUERY_STRING} !redirectURL\=/
RewriteCond %{QUERY_STRING} !redirectURL\=http://myhost\ RewriteCond %{QUERY_STRING} !redirectURL\=http%3A//myhost
RewriteRule ^/(.*) /abuse.html [L,PT]
When malicious request is detected abuse.html page is shown.
Of course mod_rewrite module has to be enabled on the server.
To avoid unexpected results and potential vulerabilities when multiple redirectURL values are passed to the application an additional rule can be added:
RewriteCond %{QUERY_STRING} redirectURL\=.*redirectURL
RewriteRule ^/(.*) /abuse.html [L,PT]
PT flag has to be used for all rewrite rules in order to WebSphere Plugin properly cooperate with mod_rewrite module.