PT-2026-46304 · Pypi · Webob
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WebOb versions prior to 1.8.10
Description
An open redirect occurs when the software normalizes the HTTP Location header to include the request hostname. The process involves parsing the redirect URL using Python's
urllib.parse and joining it to the base URL. Because urlsplit (called internally by urljoin) treats a // at the start of a string as a URI without a scheme, it interprets the subsequent part as the hostname, replacing the original request hostname.Although a previous attempt was made to mitigate this by replacing
// with /%2f, Python 3.10 and later versions of urlsplit internally strip ASCII tab, carriage return, and newline characters. Consequently, a string such as /t/attacker.com is converted to //attacker.com, bypassing the previous fix and allowing redirection to an external domain.Recommendations
Update to version 1.8.10.
As a temporary workaround, rewrite any use of the
Response class that includes a location to ensure a full URI including the hostname is passed, or validate that the redirect target starts with a scheme such as http:// or https:// before assigning it to Response.location.Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Webob