URL redirection, or an "open redirect," is a web application vulnerability. It occurs when an application's code accepts user-supplied input to determine the destination for a redirect without proper validation. An attacker can craft a URL using a trusted domain that redirects the user to a malicious site. The fundamental flaw lies within the application's logic for handling redirects. Therefore, the most effective mitigation strategy is to address the vulnerability at its source by modifying the application code to validate all redirect targets, typically by using a strict whitelist of approved URLs or by preventing redirects to external domains.

B. Users: Users are the targets of the attack via phishing, not the source of the technical vulnerability itself. User training is a secondary control.

C. Network infrastructure: Network devices like firewalls can offer layered defense but do not fix the root cause, which is the flawed logic within the application.

D. Configuration files: A configuration file might hold a whitelist for a secure implementation, but the vulnerability is the application's failure to use that configuration, not the file itself.

1. OWASP Foundation. (n.d.). Unvalidated Redirects and Forwards Cheat Sheet. OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/UnvalidatedRedirectsandForwardsCheatSheet.html. The document states

"Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to an untrusted URL." This identifies the web application as the source.

2. MITRE Corporation. (2023). CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). Common Weakness Enumeration. Retrieved from https://cwe.mitre.org/data/definitions/601.html. The description explicitly states

"The web application accepts a user-controlled input that specifies a link to an external site

and uses that link in a Redirect." This pinpoints the vulnerability's origin to the application's handling of input.

3. Boneh

D.

& Mazières

D. (2018). CS 155: Computer and Network Security

Lecture 10: Web Security Model. Stanford University. Slide 32 discusses "Open redirect" as a vulnerability where a site example.com/redirect?url=evil.com redirects to a malicious site

demonstrating it as an application-level flaw.