PT-2017-17623 · Netflix · Netflix Security Monkey

Published 2017-03-26 · Updated 2022-05-17 · CVE-2017-7266

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Netflix Security Monkey versions prior to 0.8.0

Description The issue concerns the logout functionality, which accepts a next parameter. This parameter allows redirection to any domain, regardless of the Host header, thus facilitating an open redirect.

Recommendations For versions prior to 0.8.0, update to version 0.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the next parameter in the logout functionality to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2017-7266

GHSA-J6JQ-3Q8P-XGG6

Affected Products

Netflix Security Monkey

References · 9

• https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466 · Patch
• https://osv.dev/vulnerability/GHSA-j6jq-3q8p-xgg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7266 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7266 · Vendor Advisory
• https://github.com/Netflix/security_monkey · Note
• https://github.com/Netflix/security_monkey/releases/tag/v0.8.0 · Note
• https://github.com/Netflix/security_monkey/pull/482 · Note
• http://securityfocus.com/bid/97088 · Note
• https://web.archive.org/web/20201220170714/http://securityfocus.com/bid/97088 · Note