Gfilui

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&...

The redirect is implemented in Javascript, so when you request the site, you get a 200 and some HTML + JS, not a 30X.

I recently started to notice that someone is abusing the redirect page for dubious links (guns, viagra, ...). It was suspicious that the traffic of the page increased by a lot, especially at night, when there should be barely any traffic.

I started to log the requests including referer. The referers seem to be all kinds of different hosts (not the same one every time) but mostly redirect pages themselves. Examples are

• 
  http://foo1.bar/cgi/mt4/mt4i.cgi?cat=12&mode=redirect&ref_eid=3231&url=http://my.site/redirect...


• 
  http://foo2.bar/modules/wordpress/wp-ktai.php?view=redir&url=http://my.site/redirect...


• 
  http://www.foo3.bar/core.php?p=books&l=en&do=show&tag=2774&id=20536&backlink=http://my.site/redirect...


• 
  http://www.google.sk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=172&ved=0CCMQFjABOKoB&url=http://my.site/redirect...

I'm actually in control of the URLs that users should be legitimately redirected to, so I implemented a whitelist of valid hosts and started redirecting invalid ones to my start page.

What I'm wondering is, why should someone abuse my redirect page in the described way? And are there any risks I should be aware of?

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. Very few people will click on a link to https://evilphishingsite.example.com, but they might click on https://catphotos.example.com?redirect=https://evilphishingsite.example.com, especially if it was formatted as https://catphotos.example.com to hide the redirection from casual inspection - even if you look in the status bar while hovering over that, it starts with a reasonable looking string.

The main risks are to your site reputation (it's more likely to get black listed by filtering services if they spot dubious traffic being accessed through it) and to people following these links (who knows what is actually on the other site you're sending them to). It's unlikely to result in compromise of your server directly.

If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users.

From https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet

Unvalidated redirects and forwards are possible when a web application
accepts untrusted input that could cause the web application to
redirect the request to a URL contained within untrusted input. By
modifying untrusted URL input to a malicious site, an attacker may
successfully launch a phishing scam and steal user credentials.
Because the server name in the modified link is identical to the
original site, phishing attempts may have a more trustworthy
appearance. Unvalidated redirect and forward attacks can also be used
to maliciously craft a URL that would pass the application’s access
control check and then forward the attacker to privileged functions
that they would normally not be able to access.

The crux is that using your redirect leverages the good name of your business to get someone to click on the malicious link.

Your website might not be blacklisted, unlike another.

Assuming they were using it to send spam links, it would look more reasonable if it came from a new domain. I would guess they would send spam from your site long enough for it to become blacklisted, at which point they might drop yours and try to find another.