CVE-2021-21330

Open redirect vulnerability in aiohttp < 3.7.4

• CVSS 6.1
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• Configuration Issues
• Remote

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.

CVE

CVE-2021-21330

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSS base score

6.1

Published

2021-02-26

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Open Redirects

Accessibility scope

Remote

Impact

Open Redirect

Fixed by upgrading

Yes

Solution

Update aiohttp to version 3.7.4 or higher.

from aiohttp import web
from aiohttp.web_middlewares import normalize_path_middleware

app = web.Application()

app.middlewares.append(normalize_path_middleware())

async def redirect_handler(request):
    target_url = request.query.get('url')
    return web.HTTPFound(location=target_url)

app.router.add_get('/redirect', redirect_handler)

if __name__ == '__main__':
    web.run_app(app)

from aiohttp import web
from aiohttp.web_middlewares import normalize_path_middleware
from urllib.parse import urlparse

app = web.Application()
app.middlewares.append(normalize_path_middleware())

ALLOWED_DOMAINS = {"example.com"}

async def redirect_handler(request):
    target_url = request.query.get('url', '')

    parsed = urlparse(target_url)

    if not parsed.netloc and target_url.startswith('/'):
        return web.HTTPFound(location=target_url)

    if parsed.hostname in ALLOWED_DOMAINS:
        return web.HTTPFound(location=target_url)

    return web.HTTPBadRequest(text="Invalid or disallowed redirect target.")

app.router.add_get('/redirect', redirect_handler)

if __name__ == '__main__':
    web.run_app(app)

@misc{vaitp:cve202121330,
  title        = {{Open redirect vulnerability in aiohttp < 3.7.4}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21330},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21330/}}
}