CWE-698

Execution After Redirect (EAR)

Base

Incomplete

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Parent Weaknesses (ChildOf)

Scope

Other

Confidentiality

Integrity

Availability

Impact

Alter Execution Logic, Execute Unauthorized Code or Commands

Execution-after-redirect allows access to application configuration details.

chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.

Remote attackers can obtain access to administrator functionality through EAR.

Remote attackers can obtain access to administrator functionality through EAR.

Bypass of authentication step through EAR.

Chain: Execution after redirect triggers eval injection.

chain: execution after redirect allows non-administrator to perform static code injection.

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.