CVE-2021-21330: Open redirect vulnerability in aiohttp
Impact
Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.
It is caused by a bug in the aiohttp.webmiddlewares.normalizepathmiddleware middleware.
Patches
This security problem has been fixed in v3.7.4. Upgrade your dependency as follows: [pip install aiohttp >= 3.7.4]
Workarounds
If upgrading is not an option for you, a workaround can be to avoid using aiohttp.webmiddlewares.normalizepathmiddleware in your applications.
References
[aiohttp @ PyPI] [GHSA-v6wp-4m6f-gcjg] [OWASP page on open redirects]
For more information
If you have any questions or comments about this advisory: Open an issue in the aiohttp repo Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com
Credit: [Jelmer Vernooij] and [Beast Glatisant].
[aiohttp @ PyPI]: https://pypi.org/p/aiohttp [pip install aiohttp >= 3.7.4]: https://pypi.org/project/aiohttp/3.7.4/ [GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg [OWASP page on open redirects]: https://cheatsheetseries.owasp.org/cheatsheets/UnvalidatedRedirectsandForwardsCheatSheet.html
[Jelmer Vernooij]: https://jelmer.uk [Beast Glatisant]: https://github.com/g147
Other sources
A flaw was found in python-aiohttp. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the aiohttp.webmiddlewares.normalizepathmiddleware middleware.
References:
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
— Red Hat
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the aiohttp.webmiddlewares.normalizepathmiddleware middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using aiohttp.webmiddlewares.normalizepathmiddleware in your applications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python-aiohttpto a version that resolves this vulnerability.Fixed in 3.5.1-1+deb10u1Fixed in 3.7.4-1Fixed in 3.8.4-1Fixed in 3.8.6-1 - Upgrade
Upgrade
redhat/python-aiohttpto a version that resolves this vulnerability.Fixed in 3.7.4 - Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.7.4 - Upgrade
Upgrade
aiohttpto a version that resolves this vulnerability.Fixed in 3.7.4 - Configuration
Avoid using aiohttp.web_middlewares.normalize_path_middleware in applications if upgrading is not an option.
aiohttp.web_middlewares.normalize_path_middleware usage = disabled
Event History
Frequently Asked Questions
What is the impact of CVE-2021-21330?
The impact of CVE-2021-21330 is an open redirect vulnerability that could redirect the browser to a different website.
How does CVE-2021-21330 affect aiohttp-based web servers?
CVE-2021-21330 affects aiohttp-based web servers by allowing a maliciously crafted link to redirect the browser to a different website.
Which middleware in aiohttp is responsible for the vulnerability?
The vulnerability in aiohttp is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.
What is the severity of CVE-2021-21330?
The severity of CVE-2021-21330 is medium with a CVSSv3 score of 6.1.
How do I fix CVE-2021-21330 in aiohttp?
To fix CVE-2021-21330 in aiohttp, update to version 3.7.4.