The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters…

摘要

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to re…

中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。