# Open redirect via encoding and crypto

Redirect targets in ciphertext or deny-listed URLs bypassed by unicode dots, redirect chains, or CBC splicing

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; 2 confirmed bounties: $500 and $560; latest 2022-12-29. Updated 2026-11-02._

## How it works
A redirect endpoint decides where to send the user by trusting a value it cannot actually verify. Two assumptions break. First, a deny-list validator parses a URL differently from the code that later resolves the redirect, so a look-alike character (Ideographic Full Stop) or a chain of redirects reaches a domain the validator never saw [E2](https://bugbountylibrary.com/r/h1%3A1032610.md). Second, an opaque redirect target is encrypted without integrity protection: CBC or CFB ciphertext is malleable, so an attacker who can obtain ciphertext for chosen input (an encryption oracle) or flip bits can forge a target the server will happily decrypt and follow [E1](https://bugbountylibrary.com/r/h1%3A108082.md)[E3](https://bugbountylibrary.com/r/h1%3A126203.md). In both cases the check and the use disagree about what the value means.

## Where it shows up
- Redirect parameters holding opaque ciphertext (`EQ=`, base64 blobs) rather than a signed token [E3](https://bugbountylibrary.com/r/h1%3A126203.md)
- Encryption in CBC or CFB mode with no MAC/authentication over the redirect target [E1](https://bugbountylibrary.com/r/h1%3A108082.md)[E3](https://bugbountylibrary.com/r/h1%3A126203.md)
- Any endpoint that encrypts user-controlled input and reflects the ciphertext back (share, preview, opt-out pages) — a potential oracle [E3](https://bugbountylibrary.com/r/h1%3A126203.md)
- Black-box link validators or deny-lists applied to user-posted URLs, separate from the redirect resolver [E2](https://bugbountylibrary.com/r/h1%3A1032610.md)
- Redirect chains mixing an internal trusted host with an external redirect host [E2](https://bugbountylibrary.com/r/h1%3A1032610.md)
- Unicode look-alikes (Ideographic Full Stop %E3%80%82) not normalized by the validator [E2](https://bugbountylibrary.com/r/h1%3A1032610.md)

## How to review
The invariant: the redirect destination must be authenticated end-to-end, and the component that validates a URL must be the same one that resolves it. Check that encrypted state carries a MAC or signature and is rejected on any tamper; that no endpoint returns ciphertext of attacker-chosen plaintext; and that URL validation normalizes exactly as the resolver does (same parser, same unicode handling). For deny-lists, confirm the final resolved host is checked after all redirects, not the initial string.

## How finders spotted it
- Noticed a redirect parameter was an encrypted URL, inferred CBC with 8-byte blocks from padding behavior, then hunted for a page reflecting its own encrypted URL as an oracle [E3](https://bugbountylibrary.com/r/h1%3A126203.md)
- Recognized CFB permits bitwise ciphertext manipulation and that EXE files have a predictable DOS stub, so a bit-flip redirects execution into controllable bytes [E1](https://bugbountylibrary.com/r/h1%3A108082.md)
- Probed an undocumented black-box link validator, found two open redirects, and hypothesized a parser differential, testing the Ideographic Full Stop as a period substitute [E2](https://bugbountylibrary.com/r/h1%3A1032610.md)

## Variants seen
- CBC cut-and-paste with an encryption oracle to forge arbitrary redirect targets [E3](https://bugbountylibrary.com/r/h1%3A126203.md)
- Chained internal+external open redirects plus unicode dot to defeat a deny-list [E2](https://bugbountylibrary.com/r/h1%3A1032610.md)
- Unauthenticated CFB bit-flipping to backdoor known-format files [E1](https://bugbountylibrary.com/r/h1%3A108082.md)

## Impact and severity
Forged redirects to any domain, chainable to XSS via `data:` URIs [E3](https://bugbountylibrary.com/r/h1%3A126203.md); bypass of link blocking to post forbidden domains, amplified because the link begins with the trusted host [E2](https://bugbountylibrary.com/r/h1%3A1032610.md); code injection into executables via malleable ciphertext [E1](https://bugbountylibrary.com/r/h1%3A108082.md). Severity rises with trust in the redirecting host and with chaining to script execution.

## Why fixes fail
Deny-lists that normalize differently from the resolver keep failing against unicode look-alikes and redirect chains [E2](https://bugbountylibrary.com/r/h1%3A1032610.md); encryption without a MAC leaves ciphertext malleable regardless of block mode [E1](https://bugbountylibrary.com/r/h1%3A108082.md)[E3](https://bugbountylibrary.com/r/h1%3A126203.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A108082.md
- E2: https://bugbountylibrary.com/r/h1%3A1032610.md
- E3: https://bugbountylibrary.com/r/h1%3A126203.md