From 78f5a76315891168d24e923d2b08211baefefb4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pablo=20Su=C3=A1rez=20Hern=C3=A1ndez?= Date: Thu, 22 Jun 2023 16:36:20 +0100 Subject: [PATCH] tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) (#583) --- salt/ext/tornado/web.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/salt/ext/tornado/web.py b/salt/ext/tornado/web.py index 60bde695d3..97fadcf87d 100644 --- a/salt/ext/tornado/web.py +++ b/salt/ext/tornado/web.py @@ -2544,6 +2544,15 @@ class StaticFileHandler(RequestHandler): # but there is some prefix to the path that was already # trimmed by the routing if not self.request.path.endswith("/"): + if self.request.path.startswith("//"): + # A redirect with two initial slashes is a "protocol-relative" URL. + # This means the next path segment is treated as a hostname instead + # of a part of the path, making this effectively an open redirect. + # Reject paths starting with two slashes to prevent this. + # This is only reachable under certain configurations. + raise HTTPError( + 403, "cannot redirect path with two initial slashes" + ) self.redirect(self.request.path + "/", permanent=True) return absolute_path = os.path.join(absolute_path, self.default_filename) -- 2.41.0