CVE-2021-28861

Open Redirection Vulnerability in Python library

• CVSS 7.4
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• Information Leakage
• Remote

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may lead to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

CVE

CVE-2021-28861

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSS base score

7.4

Published

2022-08-23

OWASP

A04 Insecure Design

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.10.x or higher.

import http.server

class MyHandler(http.server.BaseHTTPRequestHandler):

    def do_GET(self):

        self.send_response(301)

        self.send_header("Location", self.path)

        self.end_headers()

server = http.server.HTTPServer(("", 8000), MyHandler)

server.serve_forever()

import sys

REQUIRED_VERSION = "3.10.0"

installed_version = sys.version.split()[0]

if installed_version != REQUIRED_VERSION:
    print(f"Warning: Python version is {installed_version}, expected {REQUIRED_VERSION}.")
    print("You should upgrade Python to the required version.")
    sys.exit(1)

print(f"Python version {installed_version} is correct.")

import http.server

class MyHandler(http.server.BaseHTTPRequestHandler):

    def do_GET(self):

        self.send_response(301)

        self.send_header("Location", self.path)

        self.end_headers()

server = http.server.HTTPServer(("", 8000), MyHandler)

server.serve_forever()

@misc{vaitp:cve202128861,
  title        = {{Open Redirection Vulnerability in Python library}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-28861},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-28861/}}
}