GHSA-672h-6x89-76m5

Suggest an improvement
Source
https://github.com/advisories/GHSA-672h-6x89-76m5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-672h-6x89-76m5/GHSA-672h-6x89-76m5.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-672h-6x89-76m5
Aliases
Published
2023-12-27T00:30:25Z
Modified
2024-09-20T18:03:15.146245Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Open redirect vulnerability in Flask-Security-Too
Details

An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

Flask-Security-Too contains logic to validate that the URL specified within the next parameter is either relative or has the same network location as the requesting URL in an attempt to prevent open redirections. Previously known examples that bypassed the validation logic such as https://example/login?next=\\\\\\github.com were patched in version 4.1.0

However, examples such as https://example/login?next=/\\github.com and https://example/login?next=\\/github.com were discovered due to how web browsers normalize slashes in URLs, which makes the package vulnerable through version <=5.3.2

Additionally, with Werkzeug >=2.1.0 the autocorrectlocationheader configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug >=2.1.0 as the WSGI layer.

Database specific
{
    "nvd_published_at": "2023-12-26T22:15:13Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-08T21:47:12Z"
}
References

Affected packages

PyPI / flask-security-too

Package

Name
flask-security-too
View open source insights on deps.dev
Purl
pkg:pypi/flask-security-too

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.3.3

Affected versions

3.*

3.0.1rc1
3.0.1rc2
3.0.1rc3
3.0.1
3.0.2
3.1.0rc1
3.2.0rc1
3.2.0rc3
3.2.0rc4
3.2.0
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5

4.*

4.0.0rc1
4.0.0rc2
4.0.0
4.0.1
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6

5.*

5.0.0
5.0.1
5.0.2
5.1.0
5.1.1
5.1.2
5.2.0
5.3.0
5.3.1
5.3.2