What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 133 Stack Exchange communities.

StackOverflow bought the hyphenated site!

</kidding>

The URL http://stackoverflow.com/messages/mark-as-read?messagetypeid=128&returnurl=? will redirect to any URL in any domain.

share|improve this question
1  
I don't understand –  Andreas Bonini Jul 21 '10 at 18:08
3  
Look at the URL. stackoverflow.com/messages/… This is a security hole. –  SLaks Jul 21 '10 at 18:08
    
I did, but where is the URL from? You should specify it in your post –  Andreas Bonini Jul 21 '10 at 18:09
1  
@Kop: You can use this URL in social engineering attacks as a legitimate-looking URL that redirects to an evil site. –  SLaks Jul 21 '10 at 18:11
1  
I would re-write your post to better highlight the bug. –  jjnguy Jul 21 '10 at 18:13
    
@SLaks: how can it possibly be "legitimate-looking" if it clearly states the return url? Google has security holes too then: google.com/… (and with google's it's harder to understand what it does) –  Andreas Bonini Jul 21 '10 at 18:13
1  
@Justin:​ Done. –  SLaks Jul 21 '10 at 18:13
4  
Ah, the memories... stackoverflow.com/messages/… –  Shog9 Jul 21 '10 at 18:14
    
@Slaks, how can this be a security issue, besides sending people to harmful sites? –  jjnguy Jul 21 '10 at 18:24
3  
@Justin: It can be used in phishing emails as social engineering –  SLaks Jul 21 '10 at 18:38

4 Answers 4

up vote 1 down vote accepted

The redirect here is now only valid for sites in our network, this change will go out in a build tonight, for example:

Invalid: http://stackoverflow.com/messages/mark-as-read?messagetypeid=128&returnurl=http://www.cornify.com

Valid: http://stackoverflow.com/messages/mark-as-read?messagetypeid=128&returnurl=http://www.serverfault.com

Invalid URLs (to any other domains) simply won't cause a redirect anymore.

share|improve this answer
1  
hmmm, this still fails Open Redirect attacks, stackoverflow.com/users/login?returnurl=http://… –  Luke Hutton Sep 8 '11 at 22:25

Imagine receiving this email (also, pretend you're dumb and likely to fall for phishing scams, but stay with me here):

To: Valued Stack Overflow user

From: Jeff Atwood, stackoverflow.com

Hey there, [blank]! We had a massive database failure, and unfortunately, our user database got all messed up. Thankfully, though, the fix is easy - all we need you to do is log in to the website. We've set up a special page to help make this repair easy, so please visit Stack Overflow account repair and sign in with your OpenID, and everything will be fixed for your account.

That "Stack Overflow account repair" page, which appears to reside on stackoverflow.com actually points to an evil phisher, who's site is http://evil.stackunderflow.com. Stack Underflow happens to look identical to Stack Overflow, and when you sign in, the nefarious owner of Stack Underflow is able to transfer all of your rep points to his account!! Nooooo!!!!

Will this particular scenario ever happen? No, but I think it illustrates a point - open redirects are something to think about, since even when I look at the url, it looks like it's at stackoverflow.com, unless I read all the way to the end and see the evil.stackunderflow.com address.


To make this more evil, hover over the URL in Chrome! Chrome shows you the first portion of the URL, and after a second of hovering, then expands to show the whole URL. The URL is just long enough that it first displays this:

"http://stackoverflow.com/messages/mark-as-read?messagetypeid=128&returnurl=..."

Chrome screenshot

share|improve this answer
    
Okay, when I wrote this, I just made up the stackunderflow.com address. I had no idea it is actually a website! Too bad it's broken. –  Jared Harley Jul 21 '10 at 21:37
2  
But that's the beauty of OpenID! The most they could get would be an auth token IF you reauthorized it. That's one of the reasons why you get directed to your OpenID site and authorize there! So even if you're on a phishing site the most they can get is your base open id url. :) –  Joshua Jul 21 '10 at 21:43
    
I guess the best example against this is the Google example given in the comment above to the post. –  staticx Jul 21 '10 at 22:27

This link better highlights the real security issue:

http://stackoverflow.com/messages/mark-as-read?messagetypeid=128&returnurl=http://www.wikipedia.com

share|improve this answer
    
Not really. I can see youtube in the message text. It's worse when the URL is shortened - think, goatse trolling on /. –  Shog9 Jul 21 '10 at 18:16
    
@Shog, see my edit –  jjnguy Jul 21 '10 at 18:17
    
My vulnerability can be used in phishing emails with URL-encoding. Rickrolling posts can be fixed by moderators. –  SLaks Jul 21 '10 at 18:22
    
@Slaks, I guess I don't see the difference. –  jjnguy Jul 21 '10 at 18:25
4  
@Justin: I think he's saying that users might trust a URL that appears to be from SO outside of SO more than they'd trust, say, a random obfuscated URL. –  Shog9 Jul 21 '10 at 18:33
    
@Shog9: Exactly. –  SLaks Jul 21 '10 at 18:46
    
@SLaks and @Shog, I get it. Thanks for clarifying. –  jjnguy Jul 21 '10 at 19:12
    
Isn't this a problem with hyperlinks and HTML more than anything else? –  staticx Jul 21 '10 at 20:31
1  
@Changeling: no... There are plenty of problems caused by URLs that appear to go to one site and actually go to another, but this one requires cooperation from the apparent target in the form of a redirect to the actual target. Since SO isn't normally that kind of site, it's understandable that even savvy users might not expect it. –  Shog9 Jul 21 '10 at 20:35
    
@Shog9: But if you look at the source of the hyperlink in this particular example (above answer), there is no redirect going on.. the text of the a href is the stackoverflow URL but the a href is actually youtube. I don't see how that is a redirect. Maybe you could explain further because I must be missing something.... –  staticx Jul 21 '10 at 22:14
    
@Changeling: woops, I thought you were talking about SLaks' issue rather than jjnguy's. Yes, linking to one thing with text of another is a HTML thing - that's why most browsers display the actual URL in the status bar. –  Shog9 Jul 21 '10 at 22:18
    
@Shog9: No problem :) Lost in translation –  staticx Jul 22 '10 at 3:16

On any of the stack overflow sites it is pretty easy to disguise one url as another. Simply use the following syntax:

[http://fakeUrlThatLooksHarmless.com](http://rick-roll_d.com)

Displays as:

http://fakeUrlThatLooksHarmless.com

share|improve this answer
    
My vulnerability can be used in phishing emails with URL-encoding. –  SLaks Jul 21 '10 at 18:21
1  
Yes, true, but when I hover over the link, I can see it goes straight to your rick-roll_d.com link. Hover over one of the evil links, and I see "stackoverflow.com/blahblahblah". –  Jared Harley Jul 21 '10 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .