CVE-2024-41810 HTML injection in HTTP redirect body
Attackers can inject malicious HTML into redirect responses via controlled URLs, leading to reflected XSS in applications using Twisted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-41810?
CVE-2024-41810 is a medium-severity cross-site scripting vulnerability in twisted, published on 29 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.
Which versions are affected by CVE-2024-41810?
3 open source packages ship an affected version, including twisted. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | All versions | 24.7.0rc1 |
twisted PyPI | All versions | 24.7.0rc1 |
twisted PyPI | All versions | 24.7.0rc1 |
Products include Twisted Twisted.
How do I fix CVE-2024-41810?
Upgrade twisted to 24.7.0rc1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-41810 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41810 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in twisted
- CVE-2026-42304 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
- CVE-2014-7143 Python Twisted trustRoot is not respected in HTTP client
- CVE-2019-12855 Improper Certificate Validation in Twisted
- CVE-2023-46137 twisted.web has disordered HTTP pipeline response
- CVE-2016-1000111 Forced Browsing in Twisted
Sources
Also known as AZL-47073, AZL-47195, DEBIAN-CVE-2024-41810, GHSA-cf56-g6w6-pqq2, PYSEC-2024-75, UBUNTU-CVE-2024-41810.