Executive brief
Werkzeug is a Python library that provides utilities for building web applications, including URL routing and request handling. This vulnerability allows an attacker to craft a URL with a double slash (//) in the path that causes the application to redirect users to an arbitrary external website, potentially leading to phishing attacks or credential theft. An attacker can trick users into clicking a malicious link that appears legitimate but redirects them to a fake login page or other malicious site.
Technical details
This is an open redirect vulnerability (CWE-601) in Werkzeug's URL processing logic. The vulnerability occurs when a URL path begins with a double slash (//), which is processed incorrectly by the URL routing and redirect handling code, allowing an attacker to specify an arbitrary redirect destination. The attack requires user interaction (the victim must click the crafted link) but no authentication, and is network-accessible via HTTP requests. An attacker can craft a URL like "http://trusted-app.com//../www.attacker.com" to redirect users to attacker-controlled sites. The vulnerability was fixed in version 0.11.6 and later.
Affected products
- Pallets Werkzeug before 0.11.6
Timeline
- 2021-04-20: disclosed
- 0.11.6: patched