Open Redirect Vulnerability in Python Aiohttp Package
Summary
UBUNTU-CVE-2021-21330: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affects python-aiohttp versions < 3.0.1-1ubuntu0.1~esm1. Fixed in 3.0.1-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aiohttp is an asynchronous HTTP client/server framework designed for asyncio and Python. It allows developers to build web applications with non-blocking capabilities, making it efficient for handling multiple requests simultaneously. However, prior to version 3.7.4, Aiohttp was found to have a critical vulnerability that could lead to open redirects, potentially compromising user security.
Vulnerability Detail
The vulnerability in Aiohttp arises from a flaw in the aiohttp.web_middlewares.normalize_path_middleware middleware, which allows a malicious actor to craft a link that redirects users to an unintended website. This could lead to phishing attacks or other malicious activities, as users may be misled into providing sensitive information on a fraudulent site. The issue has been identified as CVE-2021-21330 and has a CVSS score of 3.1, indicating a medium severity level.
How To Fix
Minimum fixed version
3.0.1-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-aiohttpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not feasible, a temporary workaround is to avoid using the aiohttp.web_middlewares.normalize_path_middleware in your applications. This can help prevent the exploitation of the vulnerability until a proper update can be applied.
Conclusion
The open redirect vulnerability in the Aiohttp package poses a significant risk to applications using this framework. It is crucial for developers to upgrade to the patched version to ensure user safety and prevent potential exploitation. Utilizing tools like Vulert can further enhance security monitoring.
See every vulnerability recorded for python-aiohttp →
FAQ
The vulnerability is an open redirect issue that allows attackers to redirect users to malicious websites.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to phishing attacks, where users are redirected to fraudulent sites that mimic legitimate ones.
Yes, the vulnerability has been fixed in Aiohttp version 3.7.4 and later. It is recommended to upgrade to this version or higher.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for python-aiohttp.
