PT-2021-19810 · Unknown · Flask-Security-Too

Published 2021-05-17 · Updated 2021-12-14 · CVE-2021-32618

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Flask-Security-Too versions 3.0.0 and later

Description The issue allows redirects after successful views, such as /login, by honoring the ?next query param. The validation check utilizes Python's urlsplit library to ensure the URL specified in the next parameter is either relative or has the same netloc as the requesting URL. However, many browsers are lenient and 'fill in the blanks' when presented with a possibly incomplete URL. For example, setting http://login?next=github.com will pass the relative URL check, but many browsers will convert this to http://github.com, allowing an attacker to send a link to an unwitting user and have it redirect to any site they want. This is considered a low severity issue due to Werkzeug's default behavior of ensuring absolute Location headers, which mitigates the attack vector.

Recommendations To resolve the issue, ensure that the default Location header setting is used when employing Werkzeug. If this is not possible, use @app.after request and implement custom validation of the Location header if it is set. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-32618

GHSA-6QMF-FJ6M-686C

GHSA-GXJJ-F44V-QM94

PYSEC-2021-123

Affected Products

Flask-Security-Too

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32618 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32618 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-123 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gxjj-f44v-qm94 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6qmf-fj6m-686c · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32618 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/flask-security-too/PYSEC-2021-123.yaml · Note
• https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-6qmf-fj6m-686c · Note
• https://github.com/Flask-Middleware/flask-security/issues/486 · Note
• https://github.com/Flask-Middleware/flask-security · Note
• https://github.com/Flask-Middleware/flask-security/commit/e39bb04615050448c1b8ba4caa7dacc0edd3e405 · Note
• https://web.archive.org/web/20220410062740/https://github.com/Flask-Middleware/flask-security/pull/489 · Note
• https://web.archive.org/web/20210517211717/https://github.com/Flask-Middleware/flask-security/issues/486 · Note
• https://web.archive.org/web/20211207121851/https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-6qmf-fj6m-686c · Note