CVE-2023-49281 (published 2023-12-01T22:15Z)

Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/Cainor/Calendarinho
commit_details: repo_url: https://github.com/Cainor/Calendarinho
author: Cainor
author_date: 2023-10-11 17:11:31+03:00
msg: Full Fix for Open Redirect Issue #1
repository: repo_url: https://github.com/Cainor/Calendarinho
repo_name: Cainor/Calendarinho
description: Manage Your Large Team of Consultants
repo_language: Python
owner: Cainor
file_changes: filename: authentication.py
change_type: ModificationType.MODIFY
diff: @@ -36,10 +36,8 @@ def loginForm(request, next=''):
                 login(request, user)
                 next_url = request.POST.get('next', '')
                 if (next_url and url_has_allowed_host_and_scheme(next_url, settings.ALLOWED_HOSTS)):
-                    print("Good People")
                     return HttpResponseRedirect(next_url)
                 else:
-                    print("fucking bad shit")
                     return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
             else:
                 messages.error(request, "Invalid login details given")

programming_language: Python
repo_url: https://github.com/Cainor/Calendarinho
commit_details: repo_url: https://github.com/Cainor/Calendarinho
author: Cainor
author_date: 2023-10-11 08:32:09+03:00
msg: Fix Open Redirect - Thanks to @7hj4
repository: repo_url: https://github.com/Cainor/Calendarinho
repo_name: Cainor/Calendarinho
description: Manage Your Large Team of Consultants
repo_language: Python
owner: Cainor
file_changes: filename: authentication.py
change_type: ModificationType.MODIFY
diff: @@ -33,8 +33,9 @@ def loginForm(request, next=''):
             user = user = authenticate(username=username, password=password)
             if user and user.is_active:
                 login(request, user)
-                if 'next' in request.POST:
-                    return HttpResponseRedirect(request.POST.get('next'))
+                next_url = request.POST.get('next', '')
+                if next_url and next_url.startswith('/'):
+                    return HttpResponseRedirect(next_url)
                 else:
                     return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
             else:

programming_language: Python
repo_url: https://github.com/Cainor/Calendarinho
commit_details: repo_url: https://github.com/Cainor/Calendarinho
author: Cainor
author_date: 2023-10-11 17:09:53+03:00
msg: Full Fix for Open Redirect Issue #1
repository: repo_url: https://github.com/Cainor/Calendarinho
repo_name: Cainor/Calendarinho
description: Manage Your Large Team of Consultants
repo_language: Python
owner: Cainor
file_changes: filename: authentication.py
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,7 @@ from django.contrib import messages
 from django.contrib.auth.decorators import login_required
 from django.core.mail import EmailMessage
 from django.contrib.auth.forms import PasswordResetForm
+from django.utils.http import url_has_allowed_host_and_scheme
 import logging
 from django.conf import settings
 from .email import send_forget_password_OTP
@@ -34,9 +35,11 @@ def loginForm(request, next=''):
             if user and user.is_active:
                 login(request, user)
                 next_url = request.POST.get('next', '')
-                if next_url and next_url.startswith('/'):
+                if (next_url and url_has_allowed_host_and_scheme(next_url, settings.ALLOWED_HOSTS)):
+                    print("Good People")
                     return HttpResponseRedirect(next_url)
                 else:
+                    print("fucking bad shit")
                     return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
             else:
                 messages.error(request, "Invalid login details given")

programming_language: Python