Java - URL Redirection
$ sudo docker pull blabla1337/owasp-skf-lab:java-url-redirection
$ sudo docker run -ti -p 127.0.0.1:5000:5000 blabla1337/owasp-skf-lab:java-url-redirection
Now that the app is running let's go hacking!
The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.
Intercepting the traffic generated by the application, we note that the redirection is performed using the following call
GET /redirect?newurl=newsite
That will generate a 302 Redirect response from the server.
Inspecting the source code, it's possible to see no input validation of newurl query string parameter is in place.
public String redirect(@RequestParam(name="newurl", required=true) String newurl, Model model) {
return "redirect:"+newurl;
}
The exploitation is pretty straightforward. Replay the redirection request, but at this time change the value of newurl into another URL.
Original request
http://0.0.0.0:5000/redirect?newurl=newsite
Modified request
http://0.0.0.0:5000/redirect?newurl=https://www.google.com
Using the payload above we will be able to successfully redirect a user to any website:
Last modified 8mo ago