CVE-2008-1547: Microsoft Exchange OWA redir.asp Open Redirect Enables Phishing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw is a medium-severity open redirect with no direct compromise impact, but it is easily exploited for phishing and affects an unsupported legacy Exchange version.

What it is

The exchweb/bin/redir.asp script in Microsoft Outlook Web Access for Exchange Server 2003 SP2 (build 6.5.7638) accepts a URL parameter and redirects the browser to it without validation. An attacker can craft a link that appears to originate from the trusted OWA host but sends the victim to an arbitrary site, which is useful for phishing and credential theft.

Impact

An attacker gains the ability to redirect users from a trusted OWA URL to an attacker-controlled site, supporting phishing pages that harvest credentials or deliver further malicious content. There is no direct code execution, data read, or availability impact per the CVSS vector.

Attack surface

Reachable over the network through a crafted URL to the OWA redir.asp endpoint; no authentication is required per the CVSS vector (Au:N), but the victim must click the link, so user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.48137, 98.8th percentile) and one reference is tagged Exploit, indicating public exploit information exists.

What to do

• Apply the Microsoft security update for Exchange Server 2003 SP2 that addresses the OWA redir.asp open redirect; if no fix is available, upgrade to a supported Exchange release.
• Restrict or block external access to exchweb/bin/redir.asp at the reverse proxy or WAF, or rewrite/validate the URL parameter to allow only trusted destinations.
• Enforce phishing-resistant authentication (MFA) and user awareness training so redirected users do not enter credentials on attacker sites.
• Monitor and filter outbound links from OWA hosts to untrusted domains, and consider disabling open redirect behavior in custom OWA configurations.

Detection

• Search web/proxy logs for requests to exchweb/bin/redir.asp with a URL parameter pointing to external or non-Microsoft domains.
• Alert on OWA redir.asp responses that issue 302/301 redirects to domains outside the organization's allowlist.
• Correlate OWA access logs with subsequent authentication attempts or phishing reports from users who clicked redir.asp links.
• Monitor for mass or automated requests to redir.asp with varying URL parameter values, which may indicate scanning or phishing campaign infrastructure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.