Open redirect: Toradex

calendar Oct 5, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links that exploit an open redirect vulnerability on toradex.com's /service/share endpoint. The rule identifies links with both 'target' and 'url' query parameters present, which triggers the redirect, while excluding legitimate cases where the destination URL itself points back to toradex.com.

Sublime rule (View on GitHub)

 1name: "Open redirect: Toradex"
 2description: "Detects inbound emails containing links that exploit an open redirect vulnerability on toradex.com's /service/share endpoint. The rule identifies links with both 'target' and 'url' query parameters present, which triggers the redirect, while excluding legitimate cases where the destination URL itself points back to toradex.com."
 3type: "rule"
 4severity: "medium"
 5source: |
 6   type.inbound
 7   and any(body.links,
 8           .href_url.domain.root_domain == "toradex.com"
 9           and strings.icontains(.href_url.path, '/service/share')
10           // the redirect only fires when both params are present
11           and regex.icontains(.href_url.query_params, '(?:^|&)target=')
12           and regex.icontains(.href_url.query_params, '(?:^|&)url=')
13           // negate use of the redirect by toradex
14           and not regex.icontains(.href_url.query_params,
15                                   '(?:^|&)url=[^&]*toradex\.com'
16           )
17   )   
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Open redirect"
22detection_methods:
23  - "URL analysis"
24id: "fc9231ab-8d4b-565a-82c9-6660fc71a6e1"
to-top