Summary

Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page.
/login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic.
Additionally, due to lack of scheme validation, HTTPS Downgrade Attack can be performed on the users.

Note: This vulnerability was found by the SAST tool I am current on the development.

Details

In /login API endpoint, next value from parameter is stored in session["next_url"].

Upon completing login process, perform_login function will be returned.

If the user is successfully logged in, the user will be redirect based on parameter from next, next_url from session or default url.
Since in the previous step, we have next value stored in next_url, this may be used in performing the redirect.

This will result in the user being redirected to the malicious site.

PoC

1. Visit the the PoC link like below where hostname replaced with the host the application is being served on.

http://[hostname]/login?next=https://example.com

2. You will be redirect to http://[hostname]. Login with your account.
3. Upon login, You will be redirect to the malicious page. In this PoC, it will be https://example.com.

Impact

The attacker can redirect victims to the attacker controlled malicious website attempting to steal sensitive information from them.
Moreover, the attacker can attempt to perform HTTPS Downgrade Attack to perform Man-in-the-Middle (MitM) attack to steal sessions to perform account takeover etc.