目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-601 指向未可信站点的URL重定向(开放重定向) 类漏洞列表 963

CWE-601 指向未可信站点的URL重定向(开放重定向) 类弱点 963 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-601 属于开放重定向漏洞，指应用程序接受用户控制的输入并用于外部链接重定向。攻击者通常利用此缺陷构造恶意 URL，诱导用户点击以跳转至钓鱼或恶意网站，从而窃取凭证或传播恶意软件。开发者应避免直接使用用户输入作为重定向目标，需对目标域名进行白名单校验，或使用经过编码的内部标识符替代直接链接，确保重定向逻辑的安全可控。

MITRE CWE 官方描述
CWE：CWE-601 URL Redirection to Untrusted Site ('Open Redirect') 英文：Web 应用程序接受由用户控制的输入，该输入指定指向外部站点的链接，并在重定向中使用该链接。
常见影响 (2)
Access Control Bypass Protection Mechanism, Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that contains malware which may then compromise the user's system. In some cases, an open redirect can also enable the immediate download of a file without the user's permission, because the r…
Access Control, Confidentiality, Other Bypass Protection Mechanism, Gain Privileges or Assume Identity, Other
By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam. The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phi…
缓解措施 (5)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and Design Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Architecture and Design When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Architecture and Design Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Architecture and Design, Implementation Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly throug…
代码示例 (2)
The following code obtains a URL from the query string and then redirects the user to that URL.
$redirect_url = $_GET['url']; header("Location: " . $redirect_url);
Bad · PHP
http://example.com/example.php?url=http://malicious.example.com
Attack
The following code is a Java servlet that will receive a GET request with a url parameter in the request to redirect the browser to the address specified in the url parameter. The servlet will retrieve the url parameter value from the request and send a response to redirect the browser to the url address.
public class RedirectServlet extends HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String query = request.getQueryString(); if (query.contains("url")) { String url = request.getParameter("url"); response.sendRedirect(url); } } }
Bad · Java
<a href="http://bank.example.com/redirect?url=http://attacker.example.net">Click here to log in</a>
Attack · HTML
CVE ID 标题 CVSS 风险等级 Published
CVE-2016-10365 Elasticsearch Kibana 安全漏洞 — Kibana 6.1 - 2017-06-16
CVE-2017-8451 Elasticsearch Kibana 输入验证错误漏洞 — Elastic X-Pack Security 6.1 - 2017-06-16
CVE-2011-1594 Red Hat Spacewalk 'url_bounce'跨站请求伪造漏洞 — Red Hat Enterprise Linux 6 6.5 Medium 2014-02-05

CWE-601（指向未可信站点的URL重定向(开放重定向)） 是常见的弱点类别，本平台收录该类弱点关联的 963 条 CVE 漏洞。