CVE-2022-33146: Open redirect in web2py
Summary
CVE-2022-33146: Open redirect in web2py. Affects web2py versions < 2.22.5. Fixed in 2.22.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
web2py is a Python web framework that allows developers to build scalable and secure web applications. It provides a high-level interface for handling HTTP requests, managing databases, and implementing security measures. However, versions prior to 2.22.5 are vulnerable to an open redirect attack. This vulnerability allows a remote attacker to redirect users to arbitrary websites, potentially leading to phishing attacks.
Vulnerability Detail
The open redirect vulnerability in web2py arises from improper validation of user-supplied input. By crafting a specially crafted URL, an attacker can trick a user into visiting a malicious website. This can be achieved by manipulating the redirect parameter in the URL. The impact of this vulnerability is significant as it can be exploited to conduct phishing attacks, tricking users into divulging sensitive information or performing malicious actions on behalf of the attacker.
How To Fix
Minimum fixed version
2.22.5
This is the first release that contains the fix.
pip install --upgrade "web2py==2.22.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to web2py version 2.22.5 or later.
Conclusion
The open redirect vulnerability in web2py versions prior to 2.22.5 poses a significant risk to the security of web applications. It allows attackers to redirect users to arbitrary websites, potentially leading to phishing attacks. To mitigate this vulnerability, it is crucial to upgrade to web2py version 2.22.5 or later. Developers should promptly update their installations to ensure the security of their web applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for web2py →
FAQ
An open redirect vulnerability allows an attacker to redirect users to arbitrary websites by manipulating a URL parameter. This can be exploited for phishing attacks or to trick users into visiting malicious websites.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your web2py installation is affected by this vulnerability. Simply enter your Pipfile.lock and it will provide real-time alerts for open-source vulnerabilities.
The impact of this vulnerability is significant as it can be exploited to conduct phishing attacks. Attackers can trick users into visiting malicious websites and potentially steal sensitive information or perform malicious actions on behalf of the user.
The only known mitigation is to upgrade to web2py version 2.22.5 or later. This version includes a fix for the open redirect vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious URL and trick users into visiting it, leading to potential phishing attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
