CVE-2023-49438
Open redirect in Flask-Security-Too <=5.3.2 via crafted ?next parameter in /login and /register routes
- CVSS 6.1
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
- Configuration Issues
- Remote
An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.
- CVSS base score
- 6.1
- Published
- 2023-12-26
- OWASP
- A05 Security Misconfiguration
- Orthogonal defect classification
- Checking
- Code defect classification
- Missing Check
- Category
- Configuration Issues
- Subcategory
- Open Redirects
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Update Flask-Security-Too to version 5.3.3 or higher
Vulnerable code sample
from flask import Flask, redirect, request
app = Flask(__name__)
@app.route('/login')
def login():
next_url = request.args.get('next')
return redirect(next_url or '/home')
@app.route('/register')
def register():
next_url = request.args.get('next')
return redirect(next_url or '/home')
@app.route('/home')
def home():
return "Welcome to the home page!"
if __name__ == '__main__':
app.run()Patched code sample
from flask import Flask, redirect, request, url_for, abort
from werkzeug.exceptions import BadRequest
app = Flask(__name__)
ALLOWED_HOSTS = {'example.com', 'localhost'}
def check_url(target):
from urllib.parse import urlparse
parsed_url = urlparse(target)
return parsed_url.netloc in ALLOWED_HOSTS
@app.route('/login')
def login():
next_url = request.args.get('next')
if next_url and not check_url(next_url):
raise BadRequest("Unsafe redirect URL")
return redirect(next_url or url_for('home'))
@app.route('/register')
def register():
next_url = request.args.get('next')
if next_url and not check_url(next_url):
raise BadRequest("Unsafe redirect URL")
return redirect(next_url or url_for('home'))
@app.route('/home')
def home():
return "Welcome to the home page!"
if __name__ == '__main__':
app.run()Cite this entry
@misc{vaitp:cve202349438,
title = {{Open redirect in Flask-Security-Too <=5.3.2 via crafted ?next parameter in /login and /register routes}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2023},
note = {VAITP Python Vulnerability Dataset, entry CVE-2023-49438},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-49438/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::