Webob
Monthly
Open redirect bypass in WebOb prior to 1.8.11 enables network-accessible, unauthenticated attackers to redirect users to attacker-controlled hosts by exploiting a URL normalization gap between WebOb's validation checks and Python's urllib.parse.urljoin. The flaw exists in Response._make_location_absolute(), Request.relative_url(), and _HTTPMove subclasses including HTTPFound - a space-prefixed protocol-relative or absolute URL passes SCHEME_RE and startswith('//') guards unchanged, then urllib.parse.urljoin silently strips the leading space on Python 3.10+, resolving the remainder as a valid off-host URL. No public exploit is identified at time of analysis; vendor patch is confirmed in version 1.8.11 and the attack surface is phishing and OAuth/SSO token theft requiring the victim to follow the redirect.
WebOb provides objects for HTTP requests and responses. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open redirect bypass in WebOb prior to 1.8.11 enables network-accessible, unauthenticated attackers to redirect users to attacker-controlled hosts by exploiting a URL normalization gap between WebOb's validation checks and Python's urllib.parse.urljoin. The flaw exists in Response._make_location_absolute(), Request.relative_url(), and _HTTPMove subclasses including HTTPFound - a space-prefixed protocol-relative or absolute URL passes SCHEME_RE and startswith('//') guards unchanged, then urllib.parse.urljoin silently strips the leading space on Python 3.10+, resolving the remainder as a valid off-host URL. No public exploit is identified at time of analysis; vendor patch is confirmed in version 1.8.11 and the attack surface is phishing and OAuth/SSO token theft requiring the victim to follow the redirect.
WebOb provides objects for HTTP requests and responses. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.