Forum Discussion

OM's avatar
OM
Icon for Nimbostratus rankNimbostratus
Apr 26, 2024
Solved

Open Redirection Mitigation

hello,

ASM has a feature to mitigate the open redirection attacks when the redirect happens at the header level (i.e: with Location in response).

When the redirection is within the payload response, the ASM does not block it.

 

do you guys know about any ASM configuration that may address this issue and mitigate this kind of attack ?

 

thanks.

 

o.

ASM WAF
open redirect
payload
response
security
  • Daniel_Wolf's avatar
    Daniel_Wolf
    May 03, 2024

    Hi OM, 

     

    if this it the request: "https://website.com/redirect.jsp?url=https://google.com"
    Then url is a parameter and https://google.com is a parameter value. In ASM you can control which parameter values are allowed. Issue solved.

    Sample config:

    And the result:

     

    KR
    Daniel

     

6 Replies

Sort By
  • Lucas_Thompson's avatar
    Lucas_Thompson
    Icon for Employee rankEmployee
    Apr 30, 2024

    There are so many ways to do this, I'm not sure it's feasible but you could try. This is a good question for LLM, it came up with this simple stuff about "non-header" ways a web developer might get a browser to "go somewhere else", which is sorta like a redirect.

     

    JS redirection:

    • window.location.href: This method sets the URL of the current page. When you use this method, the browser will load the new page immediately.
    • window.location.assign(): This method is similar to window.location.href, but it does not load the new page immediately. Instead, it adds the new page to the browser's history.
    • window.location.replace(): This method replaces the current page with the new page. This means that the user will not be able to go back to the previous page.

    Form action:

    • To use the form action method, you need to set the action attribute of the form to the URL of the new page. When the form is submitted, the browser will be redirected to the new page.

    Anchor tag:

    • To use the anchor tag method, you need to set the href attribute of the anchor tag to the URL of the new page. When the anchor tag is clicked, the browser will be redirected to the new page.

    Meta tags:

    • HTML meta refresh: To use the HTML meta refresh method, you need to add a meta tag to the head section of your HTML document. The meta tag should have the following attributes:
      • name: refresh
      • content: "seconds;url=new_page_url"

     

  • SanjayP's avatar
    SanjayP
    Icon for Nacreous rankNacreous
    Apr 30, 2024

    Interesting. Did you already test this that if it isn't a HTTP redirect but could be HTML or javascript redirect from the payload, ASM doesn't block it?

    I'm not sure if custom ASM signature can be built around this that might be checked with your account representative from F5. But this can be definitely blocked with custom iRule to scan the payload and allow only whitelisted redirect URL values. 

  • zamroni777's avatar
    zamroni777
    Icon for Cumulonimbus rankCumulonimbus
    Apr 30, 2024

    you can create rules to block "window.open(....)" in http response.

    make sure it is not intended functionality created by the developer.

  • OM's avatar
    OM
    Icon for Nimbostratus rankNimbostratus
    May 03, 2024

    yes, the response is within the body... see below

    the request was something like : https://website.com/redirect.jsp?url=https://google.com

    I know that I can use iRules, but I was looking for something built-in in asm.

     

    any other hint ?

    thanks.

     

    <html>
        <script type="text/javascript">

            if(window.opener)
            {
                window.opener.top.location = 'https://google.com';
                window.close();
            }
            else
            {
                window.top.location = 'https://google.com';
            }
        </script>
    </html>  

    • Daniel_Wolf's avatar
      Daniel_Wolf
      Icon for MVP rankMVP
      May 03, 2024

      Hi OM, 

       

      if this it the request: "https://website.com/redirect.jsp?url=https://google.com"
      Then url is a parameter and https://google.com is a parameter value. In ASM you can control which parameter values are allowed. Issue solved.

      Sample config:

      And the result:

       

      KR
      Daniel

       

      • OM's avatar
        OM
        Icon for Nimbostratus rankNimbostratus
        May 03, 2024

        Thanks Daniel, that's what I did as a workaround.

        The problem with that approach is, we don't have the full picture of what the website has as redirects and I try hard to avoid false positives....

        I was hoping to have a built-in feature similar to open redirect in Location Header.

        Anyways, I will keep an eye on the other redirects and eventualy refresh the list of parameters if another false positive pops up.

         

        thanks.