Description

Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T15:17:45.923Z",
  "pubdate": "2026-09-04T15:17:45.923Z",
  "executiveSummary": "Dub contains an unvalidated open redirect vulnerability via the 'redir_url' query parameter. This flaw permits attackers to manipulate the destination of short links hosted on the trusted Dub domain, directing users to arbitrary external web resources. As a form of URL redirection, this vulnerability facilitates phishing, social engineering, and the bypass of security controls such as domain reputation filters or link-based blacklist protections. By leveraging a trusted domain, attackers significantly increase the likelihood of victim interaction, as the redirected URL appears benign to both end-users and basic automated security filters. The vulnerability does not require authentication or elevated privileges, making it accessible to any remote attacker. The primary risk involves link cloaking, which obscures malicious destinations behind legitimate infrastructure to deceive targets into providing sensitive information or visiting harmful sites.",
  "technicalDetails": "The vulnerability originates from a lack of server-side validation or an enforced domain allowlist regarding the 'redir_url' query parameter present on Dub short links. In a standard operation, Dub facilitates the redirection of users to pre-configured destination URLs. However, the application design allows for the dynamic injection of the 'redir_url' parameter, which overrides or appends to the intended destination without verifying the destination's integrity against an approved list of hosts or URI schemes.\nThe attack flow follows a predictable pattern: an attacker crafts a malicious URL consisting of the vulnerable base domain (Dub) and an appended 'redir_url' query string containing the target malicious payload URL. When a victim clicks this link, the Dub backend receives the request and processes the 'redir_url' parameter, subsequently issuing an HTTP 301 or 302 redirect response to the attacker-supplied destination. Because the initial request originates from the trusted Dub domain, traditional perimeter defenses and user trust models are undermined.\nTechnically, the absence of input sanitization or origin validation within the redirection handling logic creates an Open Redirect scenario. The application fails to distinguish between internal redirect pathways and external, potentially malicious redirections. This configuration allows attackers to bypass security mechanisms that might otherwise block the malicious destination if accessed directly. Furthermore, the use of URL encoding within the 'redir_url' parameter allows attackers to mask the malicious URI from basic signature-based detection systems.\nImpact analysis indicates that this vulnerability is highly effective for phishing campaigns where link credibility is paramount. By cloaking malicious infrastructure behind Dub's domain, the attacker evades reputation-based filters that would otherwise categorize the landing page as malicious. The post-exploitation impact includes credential harvesting, distribution of malware, and the facilitation of social engineering attacks, all while appearing to conform to the security expectations associated with the legitimate Dub service. The flaw requires no authentication or special access rights; it is exposed publicly via the network, allowing any remote user to exploit the redirection mechanism for malicious intent."
}