CWE-601 (指向未可信站点的URL重定向(开放重定向)) — Vulnerability Class 820

CWE-601 represents a critical web application vulnerability where the software accepts user-controlled input to specify a redirect destination without adequate validation. Attackers typically exploit this weakness by crafting malicious URLs that redirect victims to untrusted, phishing sites, often leveraging the trust associated with the legitimate domain to bypass security warnings. This social engineering tactic facilitates credential theft, malware distribution, or session hijacking. To mitigate this risk, developers must implement strict validation mechanisms, such as maintaining an allowlist of permitted domains or verifying that redirect parameters originate from the same origin. Additionally, using relative paths instead of absolute URLs can significantly reduce the attack surface. By ensuring that all redirection targets are explicitly trusted and verified before processing, organizations can prevent unauthorized navigation and protect users from deceptive external links.