Description

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

Related Weaknesses

CWE-705
CWE-670

Consequences

Other, Confidentiality, Integrity, Availability: Alter Execution Logic, Execute Unauthorized Code or Commands

This weakness could affect the control flow of the application and allow execution of untrusted code.

Potential Mitigations

CVE References

• CVE-2013-1402
  • Execution-after-redirect allows access to application configuration details.

• CVE-2009-1936
  • chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.

• CVE-2007-2713
  • Remote attackers can obtain access to administrator functionality through EAR.

• CVE-2007-4932
  • Remote attackers can obtain access to administrator functionality through EAR.

• CVE-2007-5578
  • Bypass of authentication step through EAR.

• CVE-2007-2713
  • Chain: Execution after redirect triggers eval injection.

• CVE-2007-6652
  • chain: execution after redirect allows non-administrator to perform static code injection.