What is URL Redirection to Untrusted Site ('Open (CWE-601)?

TL;DR: URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601) is a vulnerability where attackers can redirect users to malicious sites, leading to phishing and malware risks. Fix it by validating user inputs against a list of approved URLs.

What is URL Redirection to Untrusted Site (‘Open Redirect’)?

URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601) is a type of vulnerability that occurs when web applications accept user-controlled input specifying an external link and use it in a redirect. As defined by the MITRE Corporation under CWE-601, and classified by the OWASP Foundation under A01:2025 - Broken Access Control.

Quick Summary

URL Redirection to Untrusted Site (‘Open Redirect’) vulnerabilities allow attackers to manipulate user inputs to redirect users to malicious sites, potentially stealing their credentials or infecting them with malware. This undermines user trust and exposes sensitive information. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fix · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · URL Redirection to Untrusted Site (‘Open Redirect’) Overview · How URL Redirection to Untrusted Site (‘Open Redirect’) Works · Business Impact of URL Redirection to Untrusted Site (‘Open Redirect’) · URL Redirection to Untrusted Site (‘Open Redirect’) Attack Scenario · How to Detect URL Redirection to Untrusted Site (‘Open Redirect’) · How to Fix URL Redirection to Untrusted Site (‘Open Redirect’) · Framework-Specific Fixes for URL Redirection to Untrusted Site (‘Open Redirect’) · How to Ask AI to Check Your Code for URL Redirection to Untrusted Site (‘Open Redirect’) · URL Redirection to Untrusted Site (‘Open Redirect’) Best Practices Checklist · URL Redirection to Untrusted Site (‘Open Redirect’) FAQ · Vulnerabilities Related to URL Redirection to Untrusted Site (‘Open Redirect’) · References · Scan Your Own Site

URL Redirection to Untrusted Site (‘Open Redirect’) Overview

What: A vulnerability where web applications accept user-controlled input specifying an external link and use it in a redirect.

Why it matters: Allows attackers to manipulate user inputs to redirect users to malicious sites, potentially stealing their credentials or infecting them with malware. This undermines user trust and exposes sensitive information.

Where it occurs: In web applications that handle URL redirection based on user input without proper validation.

Who is affected: Users redirected to untrusted sites may fall victim to phishing attacks or malware infections.

Who is NOT affected: Applications that validate redirect URLs against a list of trusted domains before executing the redirection logic are not vulnerable.

How URL Redirection to Untrusted Site (‘Open Redirect’) Works

Root Cause

The root cause lies in web applications accepting user-controlled input for URL redirection without proper validation, allowing attackers to inject malicious links.

Attack Flow

1. An attacker discovers a web application that accepts redirect URLs from user inputs.
2. The attacker crafts a URL with an untrusted destination and sends it to the victim.
3. When the victim clicks on the crafted link, the application redirects them to the malicious site.
4. The victim’s credentials or sensitive information can be stolen by the attacker.

Prerequisites to Exploit

• A web application that accepts user-controlled input for URL redirection without validation.
• An attacker with knowledge of the vulnerable endpoint and ability to manipulate user inputs.

Vulnerable Code

def redirect_to_user_supplied_url(request):
    url = request.GET.get('redirect', '/')
    return HttpResponseRedirect(url)

This code is vulnerable because it accepts any URL provided by the user without validation, allowing an attacker to inject malicious links.

Secure Code

def redirect_to_trusted_url(request):
    trusted_urls = ['https://example.com/', 'http://trustedsite.com/']
    url = request.GET.get('redirect', '/')
    
    if url not in trusted_urls:
        raise ValueError("Invalid URL")
        
    return HttpResponseRedirect(url)

This code is secure because it only allows redirection to a predefined list of trusted URLs, preventing untrusted links from being executed.

Business Impact of URL Redirection to Untrusted Site (‘Open Redirect’)

Confidentiality

• Data Exposure: User credentials and sensitive information can be stolen by phishing attacks.
• Financial Losses: Reputational damage leading to loss of business and customer trust.

Integrity

• Malware Infections: Users redirected to malicious sites may download malware, compromising system integrity.

Availability

• Phishing Attacks: Phishing pages can disrupt normal user activity on legitimate websites.

URL Redirection to Untrusted Site (‘Open Redirect’) Attack Scenario

1. The attacker identifies a web application that accepts redirect URLs from user inputs.
2. The attacker crafts a malicious link with an untrusted destination and sends it to the victim.
3. When the victim clicks on the crafted link, they are redirected to the malicious site.
4. The attacker steals the victim’s credentials or infects their device with malware.

How to Detect URL Redirection to Untrusted Site (‘Open Redirect’)

Manual Testing

• [ ] Check if the application accepts redirect URLs from user inputs without validation.
• [ ] Attempt to inject malicious links and observe if they are executed by the application.

Automated Scanners (SAST / DAST)

Static analysis can detect unvalidated URL redirection logic, while dynamic testing is needed to confirm that malicious links are actually processed.

PenScan Detection

PenScan’s ZAP scanner engine actively detects untrusted redirect vulnerabilities during automated scans.

False Positive Guidance

A false positive occurs if the application validates URLs against a trusted list before executing the redirection logic.

How to Fix URL Redirection to Untrusted Site (‘Open Redirect’)

• Implement strict input validation that only allows redirection to trusted URLs.
• Use an “accept known good” strategy for validating redirect URLs.
• Ensure that user inputs are sanitized and validated against a predefined set of acceptable values.
• Reject any input that does not conform to specifications or transform it into something that does.

Framework-Specific Fixes for URL Redirection to Untrusted Site (‘Open Redirect’)

Python/Django

def safe_redirect(request):
    trusted_urls = ['https://example.com/', 'http://trustedsite.com/']
    url = request.GET.get('redirect', '/')
    
    if url not in trusted_urls:
        raise ValueError("Invalid URL")
        
    return HttpResponseRedirect(url)

Java

public void redirectToTrustedUrl(HttpServletRequest request) {
    String[] trustedUrls = {"https://example.com/", "http://trustedsite.com/"};
    String url = request.getParameter("redirect");
    
    if (!Arrays.asList(trustedUrls).contains(url)) {
        throw new IllegalArgumentException("Invalid URL");
    }
        
    response.sendRedirect(url);
}

Node.js

function safeRedirect(req, res) {
    const trustedUrls = ['https://example.com/', 'http://trustedsite.com/'];
    let url = req.query.redirect || '/';
    
    if (!trustedUrls.includes(url)) {
        throw new Error("Invalid URL");
    }
        
    res.redirect(url);
}

PHP

function safeRedirect($request) {
    $trustedUrls = ['https://example.com/', 'http://trustedsite.com/'];
    $url = isset($_GET['redirect']) ? $_GET['redirect'] : '/';
    
    if (!in_array($url, $trustedUrls)) {
        throw new Exception("Invalid URL");
    }
        
    header('Location: ' . $url);
}

How to Ask AI to Check Your Code for URL Redirection to Untrusted Site (‘Open Redirect’)

URL Redirection to Untrusted Site (‘Open Redirect’) Best Practices Checklist

• ✅ Implement strict input validation that only allows redirection to trusted URLs.
• ✅ Use an “accept known good” strategy for validating redirect URLs.
• ✅ Ensure that user inputs are sanitized and validated against a predefined set of acceptable values.
• ✅ Reject any input that does not conform to specifications or transform it into something that does.
• ✅ Test the application thoroughly after implementing these changes.

URL Redirection to Untrusted Site (‘Open Redirect’) FAQ

How does an open redirect vulnerability work?

An attacker can manipulate a web application’s input fields to redirect users to malicious sites, potentially stealing their credentials or infecting them with malware.

What are the risks of URL redirection vulnerabilities?

Users may be redirected to phishing pages that steal login details or install harmful software on their devices.

How can I detect open redirects in my application?

Manual testing involves checking for URLs containing user input and automated scanners like ZAP can help identify such issues during dynamic analysis.

What is the primary fix for CWE-601 vulnerabilities?

Use an “accept known good” validation strategy to reject or sanitize any URL that doesn’t conform to a strict set of acceptable values.

Can you show me how to prevent open redirects in Python code?

Implement input validation by checking if the redirect URL is within a predefined list of trusted domains before executing the redirection logic.

How do I test for open redirects using manual methods?

Manually modify user inputs and observe whether the application redirects users to unexpected or untrusted sites.

What are some common mistakes when fixing open redirect issues?

Relying solely on denylist-based validation can be bypassed by attackers, so always use an allowlist approach.

Vulnerabilities Related to URL Redirection to Untrusted Site (‘Open Redirect’)

References

• MITRE
• OWASP - A01:2025 - Broken Access Control
• CAPEC-178
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find URL Redirection to Untrusted Site (‘Open Redirect’) and other risks before an attacker does.