Execution After Redirect (EAR)

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Terminoloji

Alternatif adlar ve kullanım biçimleri

Redirect Without Exit

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Alter Execution LogicExecute Unauthorized Code or Commands

Etkilenen güvenlik alanları: Other, Confidentiality, Integrity, Availability

This weakness could affect the control flow of the application and allow execution of untrusted code.

Savunma

Nasıl önlenir ve çözülür?

Follow secure coding guidelines for input handling and boundary checking.
Enforce strict security reviews and automated static analysis (SAST) checks.

Doğrulama

Nasıl tespit edilir?

Black Box

This issue might not be detected if testing is performed using a web browser, because the browser might obey the redirect and move the user to a different page before the application has produced outputs that indicate something is amiss.