Summary
CodeChecker Docker images up to version 6.24.5, and CodeChecker server deployments with older Python versions, contain an open redirect when the URL starts with multiple slashes, due to Python vulnerability CVE-2021-28861.
Details
The Docker image of CodeChecker used Python 3.9.7, which makes CodeChecker vulnerable to CVE-2021-28861, when the path segment of the URL starts with multiple slashes (such as localhost:8001//attacker.com/%2F.. redirecting to attacker.com/%2F..). The same vulnerability is present in CodeChecker server deployments that are using older Python versions.
CodeChecker does not contain mitigations for this vulnerability, but it was fixed in the http.server library itself.
As of CodeChecker Docker image 6.24.6, the used Python version has been bumped to 3.10.16, fixing the issue.
Note: For other CodeChecker server deployments, CodeChecker should be run under Python 3.10.6 or above, or an older version that has CVE-2021-28861 patched. For a list of older patched Python versions, see: https://python-security.readthedocs.io/vuln/http-server-redirection.html
Impact
The vulnerability allows an attacker to create a hyperlink that looks like a legitimate CodeChecker URL, but redirects to an attacker-supplied website when clicked.
xbow-security Reporter
Summary
CodeChecker Docker images up to version 6.24.5, and CodeChecker server deployments with older Python versions, contain an open redirect when the URL starts with multiple slashes, due to Python vulnerability CVE-2021-28861.
Details
The Docker image of CodeChecker used Python 3.9.7, which makes CodeChecker vulnerable to CVE-2021-28861, when the path segment of the URL starts with multiple slashes (such as
localhost:8001//attacker.com/%2F..redirecting toattacker.com/%2F..). The same vulnerability is present in CodeChecker server deployments that are using older Python versions.CodeChecker does not contain mitigations for this vulnerability, but it was fixed in the
http.serverlibrary itself.As of CodeChecker Docker image 6.24.6, the used Python version has been bumped to 3.10.16, fixing the issue.
Note: For other CodeChecker server deployments, CodeChecker should be run under Python 3.10.6 or above, or an older version that has CVE-2021-28861 patched. For a list of older patched Python versions, see: https://python-security.readthedocs.io/vuln/http-server-redirection.html
Impact
The vulnerability allows an attacker to create a hyperlink that looks like a legitimate CodeChecker URL, but redirects to an attacker-supplied website when clicked.