CWE-698 (重定向后执行(EAR)) — Vulnerability Class 15

CWE-698, Execution After Redirect, is a logic flaw where a web application issues an HTTP redirect response but fails to terminate subsequent code execution. This weakness typically arises when developers incorrectly assume that sending a redirect header immediately halts the request processing pipeline. Attackers exploit this by manipulating the application’s control flow to execute sensitive operations, such as database modifications or privilege escalation, after the redirect has been initiated but before the client actually navigates away. Because the server continues processing, these unintended actions occur despite the user’s apparent redirection. To prevent this vulnerability, developers must explicitly enforce termination of the request handling process immediately following the redirect command. Utilizing language-specific exit statements, return keywords, or framework-provided methods that guarantee immediate flow control cessation ensures that no further code executes after the redirect header is sent, thereby neutralizing the risk of unintended side effects.