NancyFx/Nancy — pull request #1568 by nerdfury (2014-06-13 13:59:08+00:00)
Title: Consider protocol relative URLs as non-local

During a vulnerability scan a URL Redirection exploit was raised as part of the Forms Authentication login. Basically, spoofing the returnUrl parameter to an external host in format "//nancyfx.org" will redirect the user here after successful authentication.

Request Headers:

>POST /login?returnUrl=//www.acunetix.com HTTP/1.1
>Content-Length: 46
>Content-Type: application/x-www-form-urlencoded
>Host: ourhostname.com
>Connection: Keep-alive
>Accept-Encoding: gzip,deflate
>User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
>Acunetix-Product: WVS/9.0 (Acunetix Web Vulnerability Scanner - NORMAL)
>Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED
>Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htm
>Accept: */*

>Password=t3st&UserName=my@email.com

Response Headers:

>HTTP/1.1 303 See Other
>Cache-Control: private
>Content-Type: text/html
>Location: //www.acunetix.com
>Server: Microsoft-IIS/7.5
>Set-Cookie: _ncfa=JYCo5%2ftUHvCTg2rU8DAUHFbd1LZ7bAvqX09QBN%2besVU%3dA08XQRflpHzohrGhRKNkUiAd%2bj4PR4 zxtT%2fbiTCjlj01zbNaHhnZLUP%2bPlHj9OdQ; path=/; HttpOnly
>X-AspNet-Version: 4.0.30319
>X-Powered-By: ASP.NET
>Date: Thu, 12 Jun 2014 12:04:44 GMT
>Content-Length: 0
>Connection: Keep-Alive