PT-2022-9396 · Werkzeug+4 · Werkzeug+4

Noam Moshe · Published 2022-08-02 · Updated 2024-12-06 · CVE-2021-23385

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flask-Security versions all

Description This issue allows an attacker to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes. The vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behavior of Werkzeug is modified using autocorrect location header=False. It affects the get post logout redirect and get post login redirect functions.

Recommendations As a temporary workaround, consider disabling the get post logout redirect and get post login redirect functions until a patch is available. Restrict access to alternative WSGI servers other than Werkzeug to minimize the risk of exploitation. Avoid modifying the default behavior of Werkzeug using autocorrect location header=False until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-23385

DLA-3545-1

GHSA-CG8C-GC2J-2WF7

MGASA-2023-0105

OPENSUSE-SU-2022_3834-1

OPENSUSE-SU-2022_3867-1

OPENSUSE-SU-2024:13561-1

OPENSUSE-SU-2024:14555-1

SUSE-SU-2022:3834-1

SUSE-SU-2022:3867-1

SUSE-SU-2022_3867-1

USN-6792-1

Affected Products

Flask-Security

Linuxmint

Suse

Ubuntu

Werkzeug

References · 31

• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234 · Exploit
• https://advisories.mageia.org/MGASA-2023-0105.html · Security Note
• https://osv.dev/vulnerability/GHSA-cg8c-gc2j-2wf7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23385 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-23385 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3867-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6792-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23385 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23385 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14555-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3834-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23385 · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0105 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23385 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6792-1 · Vendor Advisory