Listen to this Post
CVE-2024-42353 and CVE-2026-44889 represent a class of open redirect vulnerabilities in the Pylons WebOb library, which is widely used in Python web frameworks to wrap WSGI requests and responses. The core issue resides in how WebOb normalizes the HTTP `Location` header when generating redirect responses. The library attempts to prevent off-host redirection by checking for absolute URLs or protocol-relative URLs (//...) and neutralizing them. It uses Python’s standard `urllib.parse.urljoin()` to resolve relative locations against the current request URL. The earlier fix for these CVEs introduced a manual stripping of ASCII tab, carriage return, and line feed characters from the `Location` value before the security checks and resolution.
However, a deeper bypass was discovered in Python 3.10 and later versions. The `urllib.parse.urljoin()` function, which relies on urlsplit(), automatically strips leading and trailing C0 control characters (U+0000–U+001F) and spaces from the URL string before parsing it. WebOb’s security checks—a regular expression for URI schemes and a check for a leading //—are applied to the original, un-stripped value. Therefore, a single leading space (or any C0 control character like `\x00` or \x1f) placed before a malicious URL allows the value to bypass these guards. The checks see a string starting with whitespace, not a scheme or //, so they pass it through. `urljoin()` then strips the leading whitespace, exposing the underlying malicious scheme or protocol-relative URL, and returns the absolute attacker-controlled URL, resulting in an open redirect.
The attack surface extends beyond Response.location. WebOb’s exception classes for HTTP redirects (e.g., HTTPFound, HTTPMovedPermanently) had their own, separate logic that used `urlparse.urljoin()` directly without the neutralizing checks or stripping. Thus, even a location value like `”//evil.com”` passed to `HTTPFound(location=”//evil.com”)` would redirect users off-host without any filtering. The exploitation requires user interaction to follow the link but can be highly damaging when chained in phishing or OAuth flows.
DailyCVE Form:
Platform: WebOb
Version: <=1.8.10
Vulnerability: Open Redirect
Severity: Medium
date: 2026-06-02
Prediction: 2026-06-10
What Undercode Say:
Test the open redirect bypass for Response.location
echo "from webob import Response, Request
res = Response()
res.status = '301'
res.location = ' //www.example.com/test'
req = Request.blank('/')
print(req.get_response(res).location)" | python3
Test the bypass via HTTP exception class
echo "from webob import exc
environ = {'wsgi.url_scheme': 'http', 'SERVER_NAME': 'localhost', 'SERVER_PORT': '80', 'REQUEST_METHOD': 'HEAD', 'PATH_INFO': '/'}
m = exc.HTTPFound(location='//www.example.com/test')
m(environ, lambda a, k: None)
print(m.location)" | python3
Simulate a crafted link to exploit the vulnerability
Attackers can use a URL-encoded whitespace or control character
curl -v "http://localhost/redirect?url=%20//evil.com/phish"
How Exploit: (Educational Purposes!)
- The attacker identifies a WebOb-based application with a redirection endpoint, e.g.,
/redirect?url=<target>. - They inject a value that starts with a space (or
\x00/\x1f) followed by a malicious absolute or protocol-relative URL, e.g., `?url= //evil.com` or `?url=\x1fhttps://evil.com`. - WebOb’s `_make_location_absolute()` function fails to match the leading whitespace against its regex or `//` check, passing it through to
urljoin(). - On Python 3.10+, `urljoin()` strips the leading whitespace, parses the remaining string as a valid URL, and returns the attacker’s destination (e.g.,
http://evil.com` orhttps://evil.com`). - The application sends a 3xx redirect with the attacker-controlled `Location` header.
- The user’s browser automatically follows the redirect, landing on the attacker’s phishing site, which can steal credentials or tokens.
Protection: from this CVE
– Upgrade immediately: Update to the latest patched version of WebOb where `urllib.parse.urljoin()` has been replaced with a custom RFC 3986-compliant resolver (webob.util.urljoin()) that does not strip characters.
– Input Validation: Strictly validate and sanitize all user-supplied redirect targets. Maintain an allowlist of safe domains or validate that the target is a relative path under your own domain.
– Use Absolute URLs: Ensure your application only sets the `Location` header to a fully-qualified URL where you control the hostname.
– Reject Invalid Targets: Block any redirect target that contains leading whitespace, control characters, or is protocol-relative (//) to prevent bypasses in other components.
Impact
A successful open redirect attack allows a remote, unauthenticated attacker to redirect users from a trusted site to a malicious one. This can be exploited for phishing campaigns, credential harvesting, and token theft, especially in OAuth/SSO flows where the `redirect_uri` is trusted. The integrity and confidentiality impacts are considered limited, but the scope changes as the trust boundary is crossed, potentially allowing for more serious chained attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
