Open redirection found on Samsung's official Website


An open redirection was found by me on Samsung's official site www.samsung.com



An open Redirects allow web applications to direct users to different pages within the same application or to external sites. Applications utilize redirects to aid in site navigation and, in some cases, to track how users exit the site. Open redirect vulnerabilities occur when a web application redirects clients to any arbitrary URL that can be controlled by an attacker.

Attackers can utilize open redirects to trick users into visiting a URL to a trusted site and redirecting them to a malicious site. By encoding the URL, an attacker can make it more difficult for end-users to notice the malicious destination of the redirect, even when it is passed as a URL parameter to the trusted site. Open redirects are often abused as part of phishing scams to harvest sensitive end-user data.

Samsung.com have global alexa of 241 which means thousands of user visit it daily which makes the vulnerability more dangerous as attackers can easily trick others in clicking the malicious link.




I have reported it to samsung 3 weeks before but still now it is not yet patched so now i cannot give the full detail about the vulnerability.

[UPADTE 8/2/13]

Finally the vulnerability is patched by security team of samsung last night.

so here is the POC

Vulnerable link: http://www.samsung.com/public/redirect.html?sitecode=in&pid=in_samsungindiaestore_header_20120322&URL=http://www.hackatrick.com

The above link opens this website but now its fixed. this is the screenshot of the email I got from the team last night.