CVE-2021-23393

Flask-Unchained <0.9.0 allows URL bypass via backslashes

• CVSS 5.4
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• Configuration Issues
• Remote

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

CVE

CVE-2021-23393

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSS base score

5.4

Published

2021-06-11

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Open Redirects

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Flask-Unchained to version 0.9.0 or higher.

from flask import Flask, redirect, request

app = Flask(__name__)

def _validate_redirect_url(target):
    return True

@app.route('/redirect')
def redirect():
    target = request.args.get('url')
    if _validate_redirect_url(target):
        return redirect(target)
    return 'Invalid URL', 400

if __name__ == '__main__':
    app.run()

from flask import Flask, redirect, request, abort
import re

app = Flask(__name__)

def _validate_redirect_url(target):
    if not target:
        return False
    if re.match(r'^https?://', target):
        return True
    return False

@app.route('/redirect')
def redirect():
    target = request.args.get('url')
    if _validate_redirect_url(target):
        return redirect(target)
    else:
        abort(400)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202123393,
  title        = {{Flask-Unchained <0.9.0 allows URL bypass via backslashes}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-23393},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-23393/}}
}