WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
An attacker can forge a request that he can pass to redirect an authenticated user to another arbitrary website.
Details
In the login page, we have a redirect field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI.
Paired with a parameter pollution, we can hide our malicious URI (ex: https://dns.com/?param1=im_hidden_if_theres_lot_of_args?param1=bbb).
Summary
An attacker can forge a request that he can pass to redirect an authenticated user to another arbitrary website.
Details
In the login page, we have a
redirectfield which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI.Paired with a parameter pollution, we can hide our malicious URI (ex:
https://dns.com/?param1=im_hidden_if_theres_lot_of_args?param1=bbb).PoC
https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth
This POC can leak user's position.
Impact
This could be used for phishing, and extract new data (such as redirecting to a new "log in" page, and asking another time credentials).