Skip to main content

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2021-23385

Medium
6.1/10

Summary

This affects all versions of the package Flask-Security. When using the "get_post_logout_redirect" and "get_post_login_redirect" functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as "\\\evil.com/path". This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behavior of Werkzeug is modified using "autocorrect_location_header=False". **Note:** Flask-Security is not maintained anymore.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-601 - Open Redirect

An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.

References

Advisory Timeline

  • Published