mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-27 12:01:38 +01:00
0e149e4591
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-28370 The NVD advisory mentions that the vulnerability was fixed in v6.3.2. I checked the commits in that tag, and picked the only one that's commit message described the same vulnerability as the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
40 lines
1.9 KiB
Diff
40 lines
1.9 KiB
Diff
From c5674de64189ac407e6ace51bed08899f267ae44 Mon Sep 17 00:00:00 2001
|
|
From: Ben Darnell <ben@bendarnell.com>
|
|
Date: Sat, 13 May 2023 20:58:52 -0400
|
|
Subject: [PATCH] web: Fix an open redirect in StaticFileHandler
|
|
|
|
Under some configurations the default_filename redirect could be exploited
|
|
to redirect to an attacker-controlled site. This change refuses to redirect
|
|
to URLs that could be misinterpreted.
|
|
|
|
A test case for the specific vulnerable configuration will follow after the
|
|
patch has been available.
|
|
|
|
CVE: CVE-2023-28370
|
|
Upstream-Status: Backport [https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f]
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
tornado/web.py | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/tornado/web.py b/tornado/web.py
|
|
index 546e6ec..8410880 100644
|
|
--- a/tornado/web.py
|
|
+++ b/tornado/web.py
|
|
@@ -2771,6 +2771,15 @@ class StaticFileHandler(RequestHandler):
|
|
# but there is some prefix to the path that was already
|
|
# trimmed by the routing
|
|
if not self.request.path.endswith("/"):
|
|
+ if self.request.path.startswith("//"):
|
|
+ # A redirect with two initial slashes is a "protocol-relative" URL.
|
|
+ # This means the next path segment is treated as a hostname instead
|
|
+ # of a part of the path, making this effectively an open redirect.
|
|
+ # Reject paths starting with two slashes to prevent this.
|
|
+ # This is only reachable under certain configurations.
|
|
+ raise HTTPError(
|
|
+ 403, "cannot redirect path with two initial slashes"
|
|
+ )
|
|
self.redirect(self.request.path + "/", permanent=True)
|
|
return None
|
|
absolute_path = os.path.join(absolute_path, self.default_filename)
|