NodeJS - URL Redirection

Running the app on Docker

$ sudo docker pull blabla1337/owasp-skf-lab:js-url-redirection

$ sudo docker run -ti -p 127.0.0.1:5000:5000 blabla1337/owasp-skf-lab:js-url-redirection

Now that the app is running let's go hacking!

Reconnaissance

Step 1

The application shows that there is a new version of the website available somewhere, and a click on the button "Go to new website" will redirect you to it.

If we click on the button we will be redirected on the new page http://localhost:5000/newsite

Step 2

Intercepting the traffic generated by the application, we note that the redirection is performed using the following call

GET /redirect?newurl=newsite

That will generate a 302 Redirect response from the server.

Inspecting the source code, it's possible to see no input validation of newurl query string parameter is in place.

app.all("/redirect", (req, res) => {
  let newurl = req.query.newurl;
  res.redirect(302, newurl);
});

Exploitation

The exploitation is pretty straightforward. Replay the redirection request, but at this time change the value of newurl into another URL.

Original request

http://0.0.0.0:5000/redirect?newurl=newsite

Modified request

http://0.0.0.0:5000/redirect?newurl=https://www.google.com

Using the payload above we will be able to successfully redirect a user to any website:

Additional sources

• https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_(OTG-CLIENT-004)