Repository navigation
[security] CVE-2021-28861: http.server: Open Redirection if the URL path starts with // #87389
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2021-02-14.11:42:36.898>
labels = ['type-security', 'deferred-blocker', '3.8', '3.9', '3.10', '3.11', '3.7', 'library']
title = '[security] http.server: Open Redirection if the URL path starts with //'
updated_at = <Date 2021-05-23.08:10:57.234>
user = 'https://github.com/hamzaavvan'bugs.python.org fields:
activity = <Date 2021-05-23.08:10:57.234>
actor = 'hamzaavvan'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2021-02-14.11:42:36.898>
creator = 'hamzaavvan'
dependencies = []
files = ['49808']
hgrepos = ['404']
issue_num = 43223
keywords = ['patch']
message_count = 5.0
messages = ['386945', '387193', '387284', '390047', '394193']
nosy_count = 9.0
nosy_names = ['paul.moore', 'vstinner', 'christian.heimes', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'hamzaavvan']
pr_nums = ['24848']
priority = 'deferred blocker'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43223'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']
Activity
[-][SECURITY] Open Redirection In Python 3.7 & 3.8[/-][+][security] http.server: Open Redirection if the URL path starts with //[/+][-][SECURITY] Open Redirection In Python 3.7 & 3.8[/-][+][security] http.server: Open Redirection if the URL path starts with //[/+]hamzaavvan commentedon Feb 19, 2021
As for the directory issue, not only .ssh but an attacker can use any directory to make the open redirection exploitable.
And as for the HTTP Header Location, the server does not remove extra trailing slash from the PAYLOAD uri, which seems to be the cause of vulnerability getting exploited.
http://127.0.0.1:8000//attacker.com/..%2f..%2f..%2f..%2f..%2f../%0a%0d/../.ssh
So I believe the server should check for multiple slashes and remove them from the path.
Additionally, as you've mentioned it should also prepend the host:port/ to the new_url variable before writing the HTTP Header Location because if an attacker bypasses the protection and add an extra slash the server will still redirect to the host which is getting inserted into the Location header. But honestly I need your opinion as concatenating host to the url may lead to Host Header Injection but it'll then require a different context.
Please watch the POC video.
POC Video: https://youtu.be/rLfOoEu1XXg
ambv commentedon Apr 2, 2021
Deferred the blocker to a regular release due to lack of activity in time for the current expedited releases.
[-][security] http.server: Open Redirection if the URL path starts with //[/-][+][security] http.server: Open Redirection if the URL path starts with //racha999coperation[/+][-][security] http.server: Open Redirection if the URL path starts with //[/-][+][security] http.server: Open Redirection if the URL path starts with //racha999coperation[/+][-][security] http.server: Open Redirection if the URL path starts with //racha999coperation[/-][+][security] http.server: Open Redirection if the URL path starts with //[/+][-][security] http.server: Open Redirection if the URL path starts with //racha999coperation[/-][+][security] http.server: Open Redirection if the URL path starts with //[/+]hamzaavvan commentedon May 23, 2021
Requested review for the unit test few days ago. Please check.
#24848
pablogsal commentedon May 9, 2022
Python 3.11.0 beta 2).gpshead commentedon Jun 15, 2022
The PR mentioned above has what looks reasonable as a fix but is lacking a proper test. the reporter and PR author claims to have lost access to their github account. I'll pick this up.
pythongh-87389: Fix an open redirection vulnerability in http.server.
gpshead commentedon Jun 15, 2022
#93879
gpshead commentedon Jun 16, 2022
there's no need for this to block a release, it's not a showstopper or regression. it's a known security issue. the blocking was to help it get attention. we've got attention happening now. :)
gh-87389: Fix an open redirection vulnerability in http.server. (#93879)
pythongh-87389: Fix an open redirection vulnerability in http.server. (…
pythongh-87389: Fix an open redirection vulnerability in http.server. (…
pythongh-87389: Fix an open redirection vulnerability in http.server. (…
pythongh-87389: Fix an open redirection vulnerability in http.server. (…
gh-87389: Fix an open redirection vulnerability in http.server. (GH-9…
gh-87389: Fix an open redirection vulnerability in http.server. (GH-9…
gpshead commentedon Jun 21, 2022
fixed in main, 3.11, and 3.11. the remaining branches are up to the release managers. thanks!
gh-87389: Fix an open redirection vulnerability in http.server. (GH-9…
gh-87389: Fix an open redirection vulnerability in http.server. (GH-9…
gh-87389: Fix an open redirection vulnerability in http.server. (GH-9…
Revert 30935 defer bpo45162 to 312 (#94285)
Pull in the http.server vulnerability fix from python/cpython#87389
Merge branch 'branch/http_server_vuln_fix' into 'branch/py3.8'
ngie-eign commentedon Oct 11, 2022
For the record, this reproduces on python 2.7 (I used
wget --debugto confirm that the Location field was modified). I suspect that this also reproduces on python version <3.7.Just a note for others who might be supporting python versions <3.7 in OS distributions.
vstinner commentedon Oct 12, 2022
CVE-2021-28861 was assigned to this vulnerability.
[-][security] http.server: Open Redirection if the URL path starts with //[/-][+][security] CVE-2021-28861: http.server: Open Redirection if the URL path starts with //[/+]vstinner commentedon Oct 12, 2022
I created https://python-security.readthedocs.io/vuln/http-server-redirection.html to track fixes of this vulnerability.