Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-29565

CVE-2020-29565: OpenStack Horizon Open redirect in workflow forms

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-29565
GHSA ID
GHSA-f8fh-xp28-q59m
EPSS Score
0.71302%
CWE
CWE-601
Published
5/24/2022
Updated
9/20/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
horizonpip< 15.3.215.3.2
horizonpip>= 16.0.0, < 16.2.116.2.1
horizonpip>= 17.0.0, < 18.3.318.3.3
horizonpip>= 18.4.0, < 18.6.018.6.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from insufficient validation of the 'next' parameter in workflow forms. The commit diff shows the vulnerable code in horizon/workflows/views.py's get_context_data method previously set context['REDIRECT_URL'] directly from request.GET without security checks. The patch added validation using django.utils.http.is_safe_url, confirming this was the vulnerable point. The workflow forms' redirect handling is explicitly mentioned in CVE descriptions and commit messages, making this the clear attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in Op*nSt**k *orizon ***or* **.*.*, **.x ***or* **.*.*, **.x *n* **.x ***or* **.*.*, **.*.x, *n* **.*.x. T**r* is * l**k o* v*li**tion o* t** "n*xt" p*r*m*t*r, w*i** woul* *llow som*on* to supply * m*li*ious URL in *orizon t**

Reasoning

T** vuln*r**ility st*mm** *rom insu**i*i*nt v*li**tion o* t** 'n*xt' p*r*m*t*r in work*low *orms. T** *ommit *i** s*ows t** vuln*r**l* *o** in *orizon/work*lows/vi*ws.py's **t_*ont*xt_**t* m*t*o* pr*viously s*t *ont*xt['R**IR**T_URL'] *ir**tly *rom r