GHSA-mg3v-6m49-jhp3

Source

https://github.com/advisories/GHSA-mg3v-6m49-jhp3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-mg3v-6m49-jhp3/GHSA-mg3v-6m49-jhp3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mg3v-6m49-jhp3

Aliases

CVE-2024-42353

Published

2024-08-14T17:48:06Z

Modified

2024-08-14T22:20:48.704572Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

WebOb's location header normalization during redirect leads to open redirect

Details

Impact

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. urlparse however treats a // at the start of a string as a URI without a scheme, and then treats the next part as the hostname. urljoin will then use that hostname from the second part as the hostname replacing the original one from the request.

>>> parse.urlparse("//example.com/test/path")
ParseResult(scheme='', netloc='example.com', path='/test/path', params='', query='', fragment='')

WebOb uses urljoin to take the request URI and joining the redirect location, so assuming the request URI is: https://example.org//example.com/some/path, and the URL to redirect to (for example by adding a slash automatically) is //example.com/some/path/ that gets turned by urljoin into:

>>> parse.urljoin("https://example.org//attacker.com/some/path", "//attacker.com/some/path/")
'https://attacker.com/some/path/'

Which redirects from example.org where we want the user to stay to attacker.com

Patches

This issue is patched in WebOb 1.8.8

Older versions of WebOb continue to be vulnerable to this issue, and should be avoided.

Workarounds

Any use of the Response class that includes a location can be rewritten to make sure to always pass a full URI that includes the hostname to redirect the user to.

Thanks

Sara Gao

This issue was reported via the Pylons Project Security List

Database specific

{
    "nvd_published_at": "2024-08-14T21:15:17Z",
    "cwe_ids": [
        "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-14T17:48:06Z"
}

References

Affected packages

PyPI / webob

Package

Name: webob; View open source insights on deps.dev
Purl: pkg:pypi/webob

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.8

Affected versions

0.*

0.8

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.9

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.6.1

0.9.7

0.9.7.1

0.9.8

1.*

1.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.1beta1

1.1b2

1.1rc1

1.1

1.1.1

1.2b1

1.2b2

1.2b3

1.2rc1

1.2

1.2.1

1.2.2

1.2.3

1.3

1.3.1

1.4

1.4.1

1.4.2

1.5.0a0

1.5.0a1

1.5.0b0

1.5.0

1.5.1

1.6.0a0

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0rc1

1.7.0rc2

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.8.0rc1

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

Database specific

{
    "last_known_affected_version_range": "<= 1.8.7"
}