Open redirect on non-HTTP protocols: is_safe_url not validating properly

[roks0n]

For this to work, you have to first convert IPv4 (208.118.235.20) into a decimal IP (3497454356).

GIVEN I am given a link, e.g. ​https://example.com/admin/logout/?next=ftp:3497454356
WHEN I click on the link (in this case, if I'm logged in)
THEN I am redirected to ​ftp://208.118.235.20

Above also works for ​https://example.com/admin/login/?next=ftp:3497454356

In [1]: from django.utils.http import is_safe_url

In [2]: is_safe_url('http:999999999')
Out[2]: False
In [3]: is_safe_url('ftp:999999999')
Out[3]: True
In [4]: is_safe_url('ftp:999999999/test/')
Out[4]: False

In [5]: is_safe_url('ftp:9999999999', host='example.com')
Out[5]: True
In [6]: is_safe_url('http:9999999999', host='example.com')
Out[6]: False
In [7]: is_safe_url('https:9999999999', host='example.com')
Out[7]: True

[Tim Graham <timograham@…>]

In 8339277:

[1.8.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.

This is a security fix.

[Tim Graham <timograham@…>]

In 254326cb:

[1.9.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.

This is a security fix.

[Tim Graham <timograham@…>]

In f824655b:

[1.10.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.

This is a security fix.

[Tim Graham <timograham@…>]

In 5ea48a70:

Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.

This is a security fix.

[Tim Graham <timograham@…>]

In 97e77b7b:

[1.11.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.

This is a security fix.