Impact Analysis

This vulnerability can lead to open redirect attacks, where an attacker can redirect users from a trusted site to a malicious external site.

Such redirects can be used for phishing, stealing user credentials, or distributing malware by making users believe they are navigating within a legitimate site.

Because the vulnerability requires user interaction (UI:R) and can be exploited remotely (AV:N) without privileges (PR:N), it poses a moderate risk.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in WebOb version 1.8.10. To mitigate this vulnerability, you should upgrade WebOb to version 1.8.10 or later.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in WebOb versions prior to 1.8.10 and involves the normalization of the HTTP Location header during redirects. WebOb uses Python's urljoin to combine the redirect target with the request URI. Since Python 3.10, urlsplit strips certain ASCII characters (tab, carriage return, newline) before parsing, which can cause a redirect target containing these characters to be interpreted as a protocol-relative URL pointing to an attacker-controlled host. This allows an attacker who can influence the redirect location to redirect users to arbitrary external sites instead of the intended destination.

The vulnerability bypasses a previous fix (CVE-2024-42353) that escaped leading double slashes, making it possible to exploit open redirects through crafted redirect targets.

This issue is fixed in WebOb version 1.8.10.

Useful 0 Not Useful 0