In one of his recent diaries, Johannes discussed how open redirects are actively being sought out by threat actors[1], which made me wonder about how commonly these mechanisms are actually misused… Although open redirect is not generally considered a high-impact vulnerability on its own, it can have multiple negative implications. Johannes already covered one in…
Tag: Redirects
AI, Global Security News
Lwart Environmental Solutions Expands Long-Standing Relationship with Rimini Street, Consolidating VMware and SAP Support to Regain Control of Licensing and Roadmap Decisions
Brazilian oil re‑refinery avoids forced upgrades, stabilises core systems and redirects IT investment toward business innovation
AI, Apps, Endpoint, Exploits, Global Security News, Government & Policy, malware, Risk Management
Phishing campaign exploits OAuth redirection to bypass defenses
Microsoft researchers warn that threat actors abuse OAuth redirects to target government users and deliver malware. Microsoft has warned of phishing campaigns targeting government and public-sector organizations by abusing OAuth URL redirection. Instead of stealing credentials or exploiting software flaws, attackers leverage OAuth’s legitimate by-design behavior to bypass email and browser defenses. The tactic redirects…
AI, Global Security News
Open Redirects: A Forgotten Vulnerability?, (Tue, Feb 24th)
In 2010, OWASP added “Unvalidated Redirects and Forwards” to its Top 10 list and merged it into “Sensitive Data Exposure” in 2013. Open redirects are often overlooked, and their impact is not always well understood. At first, it does not look like a big deal. The user is receiving a 3xx status code and is…