CVE-2021-21377 Open Redirect in OMERO.web
Attackers can redirect users to malicious sites after login or group switching in OMERO.web due to unvalidated URLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21377?
CVE-2021-21377 is a medium-severity vulnerability in omero-web, published on 23 Mar 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.
Weakness: CWE-601
Which versions are affected by CVE-2021-21377?
3 open source packages ship an affected version, including omero-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
omero-web PyPI | All versions | 5.9.0 |
omero-web PyPI | All versions | 5.9.0 |
omero-web PyPI | All versions | 5.9.0 |
Products include Openmicroscopy Omero.web.
How do I fix CVE-2021-21377?
Upgrade omero-web to 5.9.0 or later.
Is CVE-2021-21377 being exploited?
There is no known exploitation of CVE-2021-21377 in the wild and no public exploit code.
Other vulnerabilities in omero-web
Sources
Also known as GHSA-g4rf-pc26-6hmr, PYSEC-2021-32.