Open redirect via user-controlled URL
ID |
vbnet.inject.open_redirect |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
VB.NET |
Description
User-controlled input flows into an HTTP redirect target without validation, which may allow an open redirect to an attacker-controlled site (used for phishing and OAuth token theft). Redirect only to an allow-listed set of URLs, or verify the target is a local URL (e.g. Url.IsLocalUrl) before redirecting.
Rationale
User-controlled input flows into an HTTP redirect target without validation, which may allow an open redirect to an attacker-controlled site (used for phishing and OAuth token theft). Redirect only to an allow-listed set of URLs, or verify the target is a local URL (e.g. Url.IsLocalUrl) before redirecting.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub RedirectFromQueryString(ByVal Request As HttpRequest, ByVal Response As HttpResponse)
Dim url As String = Request.QueryString("url")
' VULNERABLE: Open redirect via user-controlled URL
Response.Redirect(url)
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.