經得起原始碼資安弱點掃描的程式設計習慣培養(十七)_OPEN_REDIRECT

pen redirect (OPEN_REDIRECT)

sink: Calling Redirect. This call passes the tainted data,

.......

(The virtual call resolves to System.Web.Mvc.Controller.Redirect(System.String).)

開放式重定向(釣魚攻擊)，頁面跳轉過程並未驗證重定向目的網址是否安全。

Before

1 2 3 4 5 6

public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) { [perform auth logic] return this.Redirect(returnUrl); }

After

1 2 3 4 5 6 7 8 9 10 11 12 13

public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) { [perform auth logic] if (Url.IsLocalUrl(returnUrl)) { return this.Redirect(returnUrl); } else { return RedirectToAction("Index", "Home"); } }一

一般來說除了驗證是否為本機路徑(非絕對路徑)，以確保攻擊者無法將使用者重新導向到惡意外部網域，也能用以下確認是相對路徑(不是絕對路徑)方式來加強驗證

After2.

1 2 3 4 5 6 7 8 9 10

Uri targetUri = null; if (Uri.TryCreate(Request.QueryString["ReturnUrl"], UriKind.Relative, out targetUri)) { Response.Redirect(targetUri.ToString()); } else { Response.Redirect("~/default.aspx"); }

Ref:

HTTP request redirections should not be open to forging attacks

https://rules.sonarsource.com/csharp/RSPEC-5146/

SEC0109 - UNVALIDATED MVC REDIRECT

https://pumascan.com/rules/

https://learn.microsoft.com/zh-tw/aspnet/mvc/overview/security/preventing-open-redirection-attacks

https://www.veracode.com/security/dotnet/cwe-601

https://knowledge-base.secureflag.com/vulnerabilities/unvalidated_redirects___forwards/open_redirect__net.html

https://csharp-video-tutorials.blogspot.com/2019/06/open-redirect-vulnerability-example.html