[PATCH] Mitigating "Covert Redirect"

Ralph Bean rbean at redhat.com
Sat May 3 02:28:39 UTC 2014


Today we looked into what of our applications where vulnerable to the
"covert redirect" vulnerability in the news today.  We found that our
OpenID provider, FedOAuth, was not generally vulnerable to the server
side aspects.  But about half of our clients had some issues with
redirection.

If an attacker somehow tricked another user into visiting a link like
this: https://copr.fedoraproject.org/login/?next=http://evilsite.com
Copr would send the user to evilsite.com after successfully
authenticating with fedoauth.

The patch for this, at first glance, is very simple:

-oid = OpenID(app, app.config["OPENID_STORE"])
+oid = OpenID(app, app.config["OPENID_STORE"], safe_roots=[])

However, the "safe_roots" argument to OpenID was only introduced in
python-openid-1.2.  The copr frontend is running on Fedora 19 and so
is, for the moment, stuck with python-openid-1.0.1.  Upgrading is
probably the best bet, but it may cause other unforeseen issues.

As a workaround, I've attached a second patch that tells copr to just ignore
the 'next' parameter and redirect always back to the copr root url.  This
second workaround patch is applied as a 'hotfix' in ansible and deployed to the
copr cloud node.

http://infrastructure.fedoraproject.org/cgit/ansible.git/commit/?id=602405b522066ad6b96ec8a924295a331544e047
-------------- next part --------------
From 753bb46f20c0c82c9361a23d2b480f0fa66fc377 Mon Sep 17 00:00:00 2001
From: Ralph Bean <rbean at redhat.com>
Date: Fri, 2 May 2014 19:42:01 -0400
Subject: [PATCH] Use flask_openid safe_roots to mitigate Covert Redirect.

---
 frontend/coprs_frontend/coprs/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/coprs_frontend/coprs/__init__.py b/frontend/coprs_frontend/coprs/__init__.py
index d69a635..b057f26 100644
--- a/frontend/coprs_frontend/coprs/__init__.py
+++ b/frontend/coprs_frontend/coprs/__init__.py
@@ -21,7 +21,7 @@ else:
     app.config.from_pyfile("/etc/copr/copr.conf", silent=True)
 
 
-oid = OpenID(app, app.config["OPENID_STORE"])
+oid = OpenID(app, app.config["OPENID_STORE"], safe_roots=[])
 db = SQLAlchemy(app)
 whooshee = Whooshee(app)
 
-- 
1.9.0

-------------- next part --------------
From a6bcf582d1e6eac201cfa1aa269538f6e9a5305a Mon Sep 17 00:00:00 2001
From: Ralph Bean <rbean at redhat.com>
Date: Fri, 2 May 2014 21:59:44 -0400
Subject: [PATCH] Just ignore the ?next= parameter as a workaround for Covert
 Redirect.

---
 frontend/coprs_frontend/coprs/views/misc.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/coprs_frontend/coprs/views/misc.py b/frontend/coprs_frontend/coprs/views/misc.py
index 4652ab4..68ebf38 100644
--- a/frontend/coprs_frontend/coprs/views/misc.py
+++ b/frontend/coprs_frontend/coprs/views/misc.py
@@ -31,7 +31,7 @@ misc = flask.Blueprint("misc", __name__)
 @oid.loginhandler
 def login():
     if flask.g.user is not None:
-        return flask.redirect(oid.get_next_url())
+        return flask.redirect(flask.request.url_root)
     else:
         return oid.try_login("https://id.fedoraproject.org/",
                              ask_for=["email", "timezone"])
@@ -75,17 +75,17 @@ def create_or_login(resp):
         if flask.request.url_root == oid.get_next_url():
             return flask.redirect(flask.url_for("coprs_ns.coprs_by_owner",
                                                 username=user.name))
-        return flask.redirect(oid.get_next_url())
+        return flask.redirect(flask.request.url_root)
     else:
         flask.flash("User '{0}' is not allowed".format(user.name))
-        return flask.redirect(oid.get_next_url())
+        return flask.redirect(flask.request.url_root)
 
 
 @misc.route("/logout/")
 def logout():
     flask.session.pop("openid", None)
     flask.flash(u"You were signed out")
-    return flask.redirect(oid.get_next_url())
+    return flask.redirect(flask.request.url_root)
 
 
 def api_login_required(f):
-- 
1.9.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/copr-devel/attachments/20140502/8f9c96cc/attachment.sig>


More information about the copr-devel mailing list