CWE-601
AllowedURL Redirection to Untrusted Site ('Open Redirect')
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
2306 vulnerabilities reference this CWE, most recent first.
GHSA-F7FH-QG34-X2XH
Vulnerability from github – Published: 2026-04-17 22:18 – Updated: 2026-05-12 13:34Summary
CDP /json/version WebSocket URL could pivot to untrusted second-hop targets.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.5 - Patched versions:
>= 2026.4.5
Impact
A browser profile could trust a CDP /json/version response whose webSocketDebuggerUrl pointed at a different host, enabling a second-hop SSRF-style pivot.
Technical Details
The fix normalizes and re-validates direct CDP WebSocket targets before connecting.
Fix
The issue was fixed in #60469. The first stable tag containing the fix is v2026.4.5, and openclaw@2026.4.14 includes the fix.
Fix Commit(s)
bc356cc8c2beaa747c71dd86cceab8f804699665- PR: #60469
Release Process Note
Users should upgrade to openclaw 2026.4.5 or newer. The latest npm release, 2026.4.14, already includes the fix.
Credits
Thanks to @tdjackey for reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43576"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-17T22:18:28Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nCDP /json/version WebSocket URL could pivot to untrusted second-hop targets.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.5`\n- Patched versions: `\u003e= 2026.4.5`\n\n## Impact\n\nA browser profile could trust a CDP `/json/version` response whose `webSocketDebuggerUrl` pointed at a different host, enabling a second-hop SSRF-style pivot.\n\n## Technical Details\n\nThe fix normalizes and re-validates direct CDP WebSocket targets before connecting.\n\n## Fix\n\nThe issue was fixed in #60469. The first stable tag containing the fix is `v2026.4.5`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `bc356cc8c2beaa747c71dd86cceab8f804699665`\n- PR: #60469\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.5 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @tdjackey for reporting this issue.",
"id": "GHSA-f7fh-qg34-x2xh",
"modified": "2026-05-12T13:34:48Z",
"published": "2026-04-17T22:18:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-f7fh-qg34-x2xh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43576"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/pull/60469"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/bc356cc8c2beaa747c71dd86cceab8f804699665"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-second-hop-ssrf-via-cdp-json-version-websocket-url"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets"
}
GHSA-F7H7-FPH4-2W62
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
{
"affected": [],
"aliases": [
"CVE-2021-24165"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-05T19:15:00Z",
"severity": "MODERATE"
},
"details": "In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.",
"id": "GHSA-f7h7-fph4-2w62",
"modified": "2022-05-24T17:46:31Z",
"published": "2022-05-24T17:46:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24165"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F7JW-44W3-2924
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:51The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
{
"affected": [],
"aliases": [
"CVE-2019-15818"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-30T13:15:00Z",
"severity": "MODERATE"
},
"details": "The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.",
"id": "GHSA-f7jw-44w3-2924",
"modified": "2024-04-04T01:51:43Z",
"published": "2022-05-24T16:55:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15818"
},
{
"type": "WEB",
"url": "https://blog.nintechnet.com/unauthenticated-option-changes-in-wordpress-simple-301-redirects-addon-bulk-uploader-plugin"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/simple-301-redirects-addon-bulk-uploader/#developers"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F7QW-5FGJ-247X
Vulnerability from github – Published: 2022-02-01 00:48 – Updated: 2022-01-31 19:08Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings.
Patches
New versions of plone.app.contenttypes have been released. Version 2.2.3 works on Plone 5.2 and will be included in Plone 5.2.7. Version 3.0.0a9 works on Plone 6 and will be included in Plone 6.0.0a3.
Note that the Products.CMFPlone package has the same problem in the 4.3 series. In Plone 5.0-5.2, the default Products.ATContentTypes version has the same problem. See advisory. For all unpatched versions of the three packages, you can use the following workaround.
Workaround
Make sure the image_view_fullscreen page is not stored in the cache. In Plone:
- Login as Manager and go to Site Setup.
- Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
- Click on the tab 'Caching operations'.
- Under 'Legacy template mappings' locate the ruleset 'Content item view'.
- From the last column ('Templates') remove 'image_view_fullscreen'.
- Click on Save.
Reporter
This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!
For more information
If you have any questions or comments about this advisory, email us at security@plone.org This is also the correct address to use when you want to report a possible vulnerability. See our security report policy.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "plone.app.contenttypes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-31T19:07:49Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nPlone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.\nThe technique is known as cache poisoning.\nAny later visitor can get redirected when clicking on a link on this page.\nUsually only anonymous users are affected, but this depends on your cache settings.\n\n### Patches\nNew versions of plone.app.contenttypes have been released.\nVersion 2.2.3 works on Plone 5.2 and will be included in Plone 5.2.7.\nVersion 3.0.0a9 works on Plone 6 and will be included in Plone 6.0.0a3.\n\nNote that the Products.CMFPlone package has the same problem in the 4.3 series.\nIn Plone 5.0-5.2, the default Products.ATContentTypes version has the same problem. See [advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).\nFor all unpatched versions of the three packages, you can use the following workaround.\n\n### Workaround\nMake sure the image_view_fullscreen page is not stored in the cache.\nIn Plone:\n\n* Login as Manager and go to Site Setup.\n* Go to the \u0027Caching\u0027 control panel. If this does not exist, or \u0027Enable caching\u0027 is not checked, you should normally not be vulnerable.\n* Click on the tab \u0027Caching operations\u0027.\n* Under \u0027Legacy template mappings\u0027 locate the ruleset \u0027Content item view\u0027.\n* From the last column (\u0027Templates\u0027) remove \u0027image_view_fullscreen\u0027.\n* Click on Save.\n\n### Reporter\nThis vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org)\nThis is also the correct address to use when you want to report a possible vulnerability.\nSee [our security report policy](https://plone.org/security/report).",
"id": "GHSA-f7qw-5fgj-247x",
"modified": "2022-01-31T19:08:58Z",
"published": "2022-02-01T00:48:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh"
},
{
"type": "WEB",
"url": "https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x"
},
{
"type": "PACKAGE",
"url": "https://github.com/plone/plone.app.contenttypes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Cross-site Scripting and Open Redirect in plone.app.contenttypes"
}
GHSA-F824-FHQW-5FWJ
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2024-08-21 18:31In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect.
{
"affected": [],
"aliases": [
"CVE-2019-16220"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-11T14:15:00Z",
"severity": "MODERATE"
},
"details": "In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect.",
"id": "GHSA-f824-fhqw-5fwj",
"modified": "2024-08-21T18:31:25Z",
"published": "2022-05-24T22:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16220"
},
{
"type": "WEB",
"url": "https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967eb88522f5c09614a28"
},
{
"type": "WEB",
"url": "https://core.trac.wordpress.org/changeset/45971"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2020/Jan/8"
},
{
"type": "WEB",
"url": "https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9863"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4599"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4677"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8FH-XP28-Q59M
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2024-09-20 21:51An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "horizon"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "horizon"
},
"ranges": [
{
"events": [
{
"introduced": "17.0.0"
},
{
"fixed": "18.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "horizon"
},
"ranges": [
{
"events": [
{
"introduced": "18.4.0"
},
{
"fixed": "18.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-29565"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-29T11:01:41Z",
"nvd_published_at": "2020-12-04T08:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.",
"id": "GHSA-f8fh-xp28-q59m",
"modified": "2024-09-20T21:51:56Z",
"published": "2022-05-24T17:35:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/252467100f75587e18df9c43ed5802ee8f0017fa"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/6c208edf323ced07b15ec4bc3879bddb91d398bc"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/9e0e333ab5277b6c396f602862ff90398cb0242b"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/baa370f84332ad41502daea29a551705696f4421"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/1865026"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/horizon"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2020-45.yaml"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/horizon/+/758841"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/horizon/+/758843"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2020-008.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4820"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/12/08/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenStack Horizon Open redirect in workflow forms"
}
GHSA-F8MP-8R5C-5PW4
Vulnerability from github – Published: 2025-01-27 21:30 – Updated: 2025-01-28 21:31An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link.
{
"affected": [],
"aliases": [
"CVE-2024-56964"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-27T19:15:17Z",
"severity": "MODERATE"
},
"details": "An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link.",
"id": "GHSA-f8mp-8r5c-5pw4",
"modified": "2025-01-28T21:31:02Z",
"published": "2025-01-27T21:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56964"
},
{
"type": "WEB",
"url": "https://github.com/ZhouZiyi1/Vuls/blob/main/241229-GuaziUsedCar/241229-GuaziUsedCar.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F92X-C56C-PF59
Vulnerability from github – Published: 2025-03-27 12:30 – Updated: 2026-04-01 18:34URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ali2woo AliNext allows Phishing. This issue affects AliNext: from n/a through 3.5.1.
{
"affected": [],
"aliases": [
"CVE-2025-30859"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-27T11:15:46Z",
"severity": "MODERATE"
},
"details": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ali2woo AliNext allows Phishing. This issue affects AliNext: from n/a through 3.5.1.",
"id": "GHSA-f92x-c56c-pf59",
"modified": "2026-04-01T18:34:08Z",
"published": "2025-03-27T12:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30859"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/ali2woo-lite/vulnerability/wordpress-alinext-plugin-3-5-1-open-redirection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F948-372F-WC53
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin allows Phishing. This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through 1.1.0.
{
"affected": [],
"aliases": [
"CVE-2025-30954"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:36Z",
"severity": "MODERATE"
},
"details": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin allows Phishing. This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through 1.1.0.",
"id": "GHSA-f948-372f-wc53",
"modified": "2026-04-01T18:35:20Z",
"published": "2025-06-06T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30954"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/gf-constant-contact/vulnerability/wordpress-wp-gravity-forms-constant-contact-plugin-1-1-0-open-redirection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F9FQ-78CH-4WMJ
Vulnerability from github – Published: 2022-11-02 19:00 – Updated: 2025-05-02 21:57In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.2rc1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43985"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-03T18:12:26Z",
"nvd_published_at": "2022-11-02T12:15:00Z",
"severity": "MODERATE"
},
"details": "In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver\u0027s `/confirm` endpoint.",
"id": "GHSA-f9fq-78ch-4wmj",
"modified": "2025-05-02T21:57:32Z",
"published": "2022-11-02T19:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43985"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/27143"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/9fb4814d29d934cef3b02fb3b2547f9fb76aaa97"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42971.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Airflow Open Redirect vulnerability"
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.