Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[GHSA-v6wp-4m6f-gcjg] Open redirect vulnerability in normalize_path_middleware middleware #5497

Closed
webknjaz opened this issue Feb 25, 2021 · 0 comments
Closed

[GHSA-v6wp-4m6f-gcjg] Open redirect vulnerability in normalize_path_middleware middleware #5497

webknjaz opened this issue Feb 25, 2021 · 0 comments
Assignees
@webknjaz
Labels
bug reproducer: present This PR or issue contains code, which reproduce the problem described or clearly understandable STR server

Comments

@webknjaz
Copy link
Member

webknjaz commented Feb 25, 2021 •
edited
Loading

🐞 Describe the bug

$sbj. A maliciously constructed link could trick an aiohttp app using normalize_path_middleware to issue an HTTP redirect to a foreign website. But not anymore. Fixed in v3.7.4.

📋 Logs/tracebacks

See GHSA-v6wp-4m6f-gcjg.

📋 Additional context

OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

Our security policy: https://github.com/aio-libs/aiohttp/security/policy (TL;DR — never report security bugs in public, use designated emails for this)

👏 Credits

Thanks to @jelmer and @g147 for reporting and fixing this.
@webknjaz webknjaz added the bug label Feb 25, 2021
@webknjaz webknjaz self-assigned this Feb 25, 2021
webknjaz added a commit that referenced this issue Feb 25, 2021
@webknjaz
Point the change note to the issue #5497
d2f9a83
@webknjaz webknjaz changed the title change note placeholder [GHSA-v6wp-4m6f-gcjg] Open redirect vulnerability in normalize_path_middleware middleware Feb 25, 2021
@webknjaz webknjaz added reproducer: present This PR or issue contains code, which reproduce the problem described or clearly understandable STR server labels Feb 25, 2021
@aio-libs aio-libs locked as resolved and limited conversation to collaborators Feb 25, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@webknjaz webknjaz

Labels
bug reproducer: present This PR or issue contains code, which reproduce the problem described or clearly understandable STR server
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@webknjaz