PT-2024-6608 · Webob+6 · Webob+6
Sara Gao
·
Published
2024-08-14
·
Updated
2024-12-19
·
CVE-2024-42353
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
WebOb versions prior to 1.8.8
Description:
The issue is related to the handling of HTTP Location headers in WebOb, where the
urlparse and urljoin functions can be exploited to redirect users to arbitrary URLs. This occurs when the urlparse function treats a string starting with // as a URI without a scheme, and the urljoin function uses the hostname from the second part of the string, replacing the original hostname from the request. This can allow a remote attacker to redirect users to malicious sites.Recommendations:
For WebOb versions prior to 1.8.8, upgrade to version 1.8.8 to patch the vulnerability. As a temporary workaround, consider rewriting any use of the
Response class that includes a location to always pass a full URI that includes the hostname to redirect the user to. Restrict access to the vulnerable urlparse and urljoin functions to minimize the risk of exploitation. Avoid using the // notation at the start of URLs to prevent potential redirects to malicious sites.Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Red Os
Suse
Ubuntu
Webob