Vulnerability Description
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flask-Security Project | Flask-Security | All versions |
Related Weaknesses (CWE)
References
- https://github.com/mattupstate/flask-securityProductThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html
- https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234ExploitThird Party Advisory
- https://snyk.io/blog/url-confusion-vulnerabilities/Technical DescriptionThird Party Advisory
- https://github.com/mattupstate/flask-securityProductThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html
- https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234ExploitThird Party Advisory
- https://snyk.io/blog/url-confusion-vulnerabilities/Technical DescriptionThird Party Advisory
FAQ
What is CVE-2021-23385?
CVE-2021-23385 is a vulnerability with a CVSS score of 5.4 (MEDIUM). This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an ar...
How severe is CVE-2021-23385?
CVE-2021-23385 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-23385?
Check the references section above for vendor advisories and patch information. Affected products include: Flask-Security Project Flask-Security.