CVE-2024-41810

HTML injection vulnerability in `redirectTo` may lead to XSS attacks.

• CVSS 6.1
• CWE-79
• Input Validation and Sanitization
• Remote

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.

CVE

CVE-2024-41810

CWE

CWE-79

CVSS base score

6.1

Published

2024-07-29

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Twisted

Fixed by upgrading

Yes

Solution

Upgrade to Twisted version 24.7.0rc1 or later.

from twisted.web import server, resource
from twisted.web.util import redirectTo
from twisted.internet import reactor

class MyResource(resource.Resource):
    isLeaf = True

    def render_GET(self, request):
        redirect_url = request.args.get(b'url', [b'/'])[0].decode('utf-8')
        return redirectTo(redirect_url, request)

site = server.Site(MyResource())
reactor.listenTCP(8080, site)
reactor.run()

from twisted.web import server, resource
from twisted.web.util import redirectTo
from twisted.internet import reactor
from urllib.parse import urlparse

class MyResource(resource.Resource):
    isLeaf = True

    def render_GET(self, request):
        redirect_url = request.args.get(b'url', [b'/'])[0].decode('utf-8')

        parsed = urlparse(redirect_url)

        if parsed.netloc or not redirect_url.startswith('/'):
            request.setResponseCode(400)
            return b'Invalid redirect target'

        return redirectTo(redirect_url.encode('utf-8'), request)

site = server.Site(MyResource())
reactor.listenTCP(8080, site)
reactor.run()

<script>alert('XSS')</script>

@misc{vaitp:cve202441810,
  title        = {{HTML injection vulnerability in `redirectTo` may lead to XSS attacks.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-41810},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-41810/}}
}