3

I have a site located at

https://gooddomain.com/wonderful?returnPath=goodThings

which redirects me to

https://gooddomain.com/somegoodplace/goodThings

At the server side, the redirect is defined by

String path = request.getparameter("retrunPath");
String rPath = "redirect:/somegoodplace/"+ path;
return new ModelAndView(rPath, model);

Is there a payload for 'returnPath' parameter which an attacker can use to redirect an unsuspecting user to https://evil.com.

Or

Is the risk of open redirection completely mitigated with the use of redirect prefix?

Is there any other attack possible with this code? [perhaps XSS as user supplied value gets reflected on the address bar.]

hax
  • 3,851
  • 1
  • 16
  • 34
  • First of all, is goodThings required to be a link at all? – tungsten Oct 02 '19 at 17:55
  • No. Since this there is nothing executed server-side, (most) critical vulnerabilities are excluded. basically it will be just the same as the user enter it manually in the browser. Force the user to enter a url starting with a protocol handler and don't allow the use of random text. such as [end path] + ../../../../../needle/ – tungsten Oct 02 '19 at 18:17
  • @tungsten Thank you for your input. I know 'goodThings' isn't required. This is just a sample. – hax Oct 02 '19 at 18:21

1 Answers1

3

Is there a payload for 'returnPath' parameter which an attacker can use to redirect an unsuspecting user to https://evil.com.

No.If you only control a part of redirection URL a Open redirect vulnerability is not possible in such a case.

Is there any other attack possible with this code? [perhaps XSS as user supplied value gets reflected on the address bar.

XSS is definitely possible but it is impossible to answer with the information you have provided.Maybe the returnPath variable gets reflected back into the html page without input sanitization,Maybe its gets stored and then reflected without sanitization(far fetched) or maybe it gets printed via Sinks(DOM based).

Is there any other attack possible with this code?

By that i assume the three line code you pasted?No.

yeah_well
  • 3,699
  • 1
  • 13
  • 30