Ville Brofeldt created SUPERSET-22: -------------------------------------- Summary: Superset security issue - Redirect vulnerability 2022-02-14 Key: SUPERSET-22 URL: https://issues.apache.org/jira/browse/SUPERSET-22 Project: Superset Issue Type: Task Reporter: Ville Brofeldt
Email thread: [https://lists.apache.org/thread/o378k65nskf0f6l3o85gfrsmvtgtdmfm] Hi, I have come across an open redirect vulnerability in latest Apache Supsrset version (1.4.1). It allows redirects not just to http and https schemes, but also to arbitrary protocols like `ftp`. Poc: https://superset_url/login/?next=https://any_malicious_domain.com https://superset_url/login/?next=ftp://any_malicious_domain.com In some older browsers, it might also be possible to convert it into an XSS using `javascript:` prefix for scheme specification. Though not critical, this should not be allowed as it can be leveraged in different attacks including phishing. Please review! Thanks! -- This message was sent by Atlassian Jira (v8.20.1#820001)