Open Redirect Affecting flask-security package, versions [0,]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.07% (35th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Open Redirect vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-FLASKSECURITY-6140501
  • published31 Dec 2023
  • disclosed26 Dec 2023
  • creditBrandon T. Elliott

Introduced: 26 Dec 2023

CVE-2023-49438  (opens in a new tab)
CWE-601  (opens in a new tab)

How to fix?

There is no fixed version for Flask-Security.

Overview

Flask-Security is a Simple security for Flask apps.

Affected versions of this package are vulnerable to Open Redirect via the the /login and /register routes, using the ?next parameter.

Note:

With Werkzeug >=2.1.0 the autocorrect_location_header configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug >=2.1.0 as the WSGI layer.

Workaround

Adding these configuration options to your app will mitigate all currently known examples:

app.config['SECURITY_REDIRECT_VALIDATE_MODE'] = "regex"

app.config['SECURITY_REDIRECT_VALIDATE_RE'] = r"^/{4,}|\\{3,}|[\s\000-\037][/\\]{2,}(?![/\\])|[/\\]([^/\\]|/[^/\\])*[/\\].*"

Note: The vulnerability present in this library and represented by CVE-2021-23385 included the present vulnerability as well. As this package is not maintained, no fix for this vulnerability is expected. Migrating to a maintained library like Flask-Security-Too is advised.

PoC

https://example/login?next=/\github.com

https://example/login?next=\/github.com

CVSS Scores

version 3.1