Issues » Arbitrary URL redirects Description: Using an arbitrary URL redirect a attacker is able to send visiting clients to a web site of the attacker’s choosing. To successfully mount such a attack the attacker prepares a link to the dotCMS site that looks like a innocent link to an article.

URL Redirection is a vulnerability which allows an attacker to force users of your application to an untrusted external site. The attack is most often performed by delivering a link to the victim, who then clicks the link and is unknowingly redirected to the malicious website.

An Open Redirect Vulnerability entails an attacker manipulating the user and redirecting them from one site to another site – which may be malicious. However, Open Redirect Vulnerabilities can help attackers in ways that go far beyond phishing.

One of the main uses for this vulnerability is to make phishing attacks more credible and effective. When an Open Redirect is used in a phishing attack, the victim receives an email that looks legitimate with a link that points to a correct and expected domain.

Preventing Unvalidated Redirects and Forwards Simply avoid using redirects and forwards. If used, do not allow the URL as user input for the destination. Where possible, have the user provide short name, ID or token which is mapped server-side to a full target URL.

If you allow open redirects, an attacker can send a phishing email that contains a link with your domain name and the victim will be redirected from your web server to the attacker’s site.

Because the Google platforms accept open redirects, they do not verify the target URL. “An attacker only needs to replace the target URL in a legitimate redirecting URL to their own attack site,” he says.

OWASP Top 10 is an online document on OWASP’s website that provides ranking of and remediation guidance for the top 10 most critical web application security risks. The report is based on a consensus among security experts from around the world.

Forward Domain

1. If you have not yet done so, please log in to your IONOS Customer Account.
2. Click on the Domain & SSL tile and select the desired domain.
3. Select the Adjust Destination link on the Details tab.
4. Click on Domain Forwarding.
5. Select Your Domain or Arbitrary URL as Type.
6. Decide on a redirect type.