| Details | |
|---|---|
| Alert ID | 210019-2 |
| Alert Type | Tool |
| Status | alpha |
| Risk | Medium |
| CWE | 601 |
| WASC | |
| Technologies Targeted | All |
| Tags |
CWE-601 OWASP_2021_A01 TOOL_PTK |
Summary
Tainted value passed to location.assign.
Generated by OWASP PTK IAST Module
Solution
• Disallow absolute external URLs from untrusted sources. • Resolve destinations against strict allow-lists. • Treat hash route and referrer data as untrusted input.Other Info
References
- https://owasp.org/www-community/attacks/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
- https://cwe.mitre.org/data/definitions/601.html