Medium, CVSS 4.7PyPIAmendedPublished
Flask-Security has an Open Redirect issue
GHSA-w2j7-f3c6-g8cw
- Affected
- PyPI flask-security <= 5.8.0
- Fixed in
- 5.8.1· Vendor fix available
- Issue
- Open Redirect in Flask-Security Summary flasksecurity.utils.validateredirecturl() can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: Python's urlsplit() parses the full authority as evil.com\.whitelist.com or evil.com%5C.whitelist.com. Because the value ends with .whitelist.com, validateredirecturl() accepts it as an allowed subdomain of whitelist.com. This is similar in class to the previous Flask-Security-Too open redirect advisory CVE-2023-49438 / GHSA-672h-6x89-76m5, where crafted redirect URLs bypassed validation through browser URL normalization behavior. Affected Configuration The issue requires subdomain redirects to be enabled: Tested environment: Impact An attacker can craft a URL that passes Flask-Security's redirect validation and produces a 302 response to an attacker-controlled URL-like authority. This can be used for phishing or other attacks that rely on a trusted application…
Recommended action: Upgrade to 5.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.