Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21330

CVE-2021-21330: `aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)

3.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21330
GHSA ID
GHSA-v6wp-4m6f-gcjg
EPSS Score
0.67123%
CWE
CWE-601
Published
2/26/2021
Updated
9/3/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
aiohttppip< 3.7.43.7.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability was explicitly tied to the normalize_path_middleware middleware. The GitHub commit diff shows the security fix added a regex substitution (re.sub('^//+', '/', path)) in the middleware's implementation function to limit leading slashes. This code modification directly addresses the open redirect vector by ensuring the Location header's path starts with exactly one slash. The vulnerability manifests in the path processing loop where unvalidated paths could lead to unsafe redirects.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Op*n r**ir**t vuln*r**ility — * m*li*iously *r**t** link to *n *io*ttp-**s** w**-s*rv*r *oul* r**ir**t t** *rows*r to * *i***r*nt w**sit*. It is **us** *y * *u* in t** `*io*ttp.w**_mi**l*w*r*s.norm*liz*_p*t*_mi**l*w*r*` mi**l*w*r*. ###

Reasoning

T** vuln*r**ility w*s *xpli*itly ti** to t** norm*liz*_p*t*_mi**l*w*r* mi**l*w*r*. T** *it*u* *ommit *i** s*ows t** s**urity *ix ***** * r***x su*stitution (r*.su*('^//+', '/', p*t*)) in t** mi**l*w*r*'s impl*m*nt*tion *un*tion to limit l***in* sl*s*