CVE-2017-1002150

Open redirect in python-fedora <= 0.8.0 results in CSRF protection loss

• CVSS 6.1
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• Cryptographic
• Remote

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection

CVE

CVE-2017-1002150

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSS base score

6.1

Published

2017-09-14

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update python-fedora to version 0.9.0 or higher.

from flask import Flask, redirect, request

app = Flask(__name__)

@app.route('/redirect')
def redirect():
    next_url = request.args.get('next')
    return redirect(next_url)

if __name__ == '__main__':
    app.run()

from flask import Flask, redirect, request, url_for, abort

app = Flask(__name__)

ALLOWED_HOSTS = {'example.com', 'another-example.com'}

def is_safe_url(target):
    from urllib.parse import urlparse
    parsed_url = urlparse(target)
    return parsed_url.netloc in ALLOWED_HOSTS

@app.route('/redirect')
def redirect():
    next_url = request.args.get('next')
    if next_url and is_safe_url(next_url):
        return redirect(next_url)
    else:
        abort(400)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20171002150,
  title        = {{Open redirect in python-fedora <= 0.8.0 results in CSRF protection loss}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-1002150},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-1002150/}}
}