CVE-2021-32618

Flask-Security-Too allows open redirects via the "next" parameter

• CVSS 6.1
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• Configuration Issues
• Remote

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example – setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute – thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`.

CVE

CVE-2021-32618

CWE

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSS base score

6.1

Published

2021-05-17

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Configuration Issues

Subcategory

Open Redirects

Accessibility scope

Remote

Impact

Open Redirect

Solution

Set 'autocorrect_location_header=False' to mitigate the vulnerability.

from flask import Flask, request, redirect
from flask_security import Security, SQLAlchemyUserDatastore, UserMixin, RoleMixin, login_required
from flask_sqlalchemy import SQLAlchemy

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///:memory:'
app.config['SECRET_KEY'] = 'super-secret'
app.config['SECURITY_REGISTERABLE'] = True
app.config['SECURITY_REDIRECT_BEHAVIOR'] = 'spa'
db = SQLAlchemy(app)

roles_users = db.Table('roles_users',
        db.Column('user_id', db.Integer(), db.ForeignKey('user.id')),
        db.Column('role_id', db.Integer(), db.ForeignKey('role.id')))

class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True)

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(255), unique=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())

user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

@app.before_first_request
def create_user():
    db.create_all()
    if not User.query.first():
        user_datastore.create_user(email='user@example.com', password='password')
        db.session.commit()

@app.route('/')
@login_required
def home():
    return 'Welcome! You are logged in.'

@app.route('/login')
def login():
    next_url = request.args.get('next')
    if next_url:
        return redirect(next_url)
    return 'Please log in.'

if __name__ == '__main__':
    app.run()

from flask import Flask, request, redirect, url_for
from flask_security import Security, SQLAlchemyUserDatastore, UserMixin, RoleMixin, login_required
from flask_sqlalchemy import SQLAlchemy
from urllib.parse import urlparse, urljoin

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///:memory:'
app.config['SECRET_KEY'] = 'super-secret'
app.config['SECURITY_REGISTERABLE'] = True
db = SQLAlchemy(app)

roles_users = db.Table('roles_users',
        db.Column('user_id', db.Integer(), db.ForeignKey('user.id')),
        db.Column('role_id', db.Integer(), db.ForeignKey('role.id')))

class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True)

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(255), unique=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())

user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

def check_url(target):
    ref_url = urlparse(request.host_url)
    test_url = urlparse(urljoin(request.host_url, target))
    return test_url.scheme in ('http', 'https') and \
           ref_url.netloc == test_url.netloc

@app.before_first_request
def create_user():
    db.create_all()
    if not User.query.first():
        user_datastore.create_user(email='user@example.com', password='password')
        db.session.commit()

@app.route('/')
@login_required
def home():
    return 'Welcome! You are logged in.'

@app.route('/login')
def login():
    next_url = request.args.get('next')
    if next_url and check_url(next_url):
        return redirect(next_url)
    return 'Please log in.'

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202132618,
  title        = {{Flask-Security-Too allows open redirects via the "next" parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-32618},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-32618/}}
}