CWE-601 Open Redirect

Coverage: 14 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 13Other-pattern 1 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged redirect logic where an attacker can influence the redirect destination.

Why it matters

Open redirects enable phishing and token leakage.

• Phishing: attackers use your trusted domain to bounce users to a malicious site.
• Auth leakage: misconfigured OAuth flows can leak codes/tokens via redirects.

Safer examples

1) Only allow relative redirects

const next = req.query.next || "/dashboard";
if (!next.startsWith("/")) throw new Error("Invalid redirect");
res.redirect(next);

2) If you must allow absolute URLs, allowlist hosts

Reject redirects to unknown domains, and normalize before comparing.

3) Avoid reflecting arbitrary URLs

Use server-side route names or IDs rather than raw URLs from the client.

How SiteShadow detects it (high level)

• Flags redirect(...) calls using request-derived parameters (next, returnUrl, redirect).
• Checks for missing allowlists/validation around redirect destinations.

References

• CWE-601: https://cwe.mitre.org/data/definitions/601.html

---

← Back to Vulnerability Library