CVE-2021-23385

What it actually does

Open redirect flaw allowing bypass of URL validation in get_post_logout_redirect and get_post_login_redirect via multiple backslashes when non-default WSGI servers or Werkzeug autocorrect_location_header=False is used.

Why it matters to the business

Attackers can redirect users to malicious sites, increasing risk of phishing or credential theft; low exploit probability but affects widely used components with available public exploits and long exposure window.

How an attack unfolds

An attacker crafts a request supplying multiple backslashes before an external domain in redirect parameters; when the application uses a non-Werkzeug WSGI server or disables location header correction, the malformed URL passes validation and the victim is sent to the attacker-controlled site.

How to fix it

Upgrade opensearch to commit 64d2aa341cf591dd20ab3966792e564a467fdcf7 and anomaly-detection to commit 88a3f2b85ce2bcf4ced144d42f5bf96111b82743; replace Flask-Security with a maintained fork or alternative; enforce strict allow-list validation on all redirect targets; set autocorrect_location_header=True when using Werkzeug.

How to confirm the fix worked

Confirm packages report the listed commit hashes; test redirect endpoints with multiple-backslash payloads and verify only allow-listed domains are accepted; review WSGI configuration for autocorrect_location_header setting.

Typical attack path

1. Identify login or logout endpoints that invoke get_post_login_redirect or get_post_logout_redirect
2. Append multiple backslashes followed by an external domain to the redirect parameter
3. Deliver the crafted link to a victim or trigger via automated request
4. Victim browser follows the redirect to the attacker site

How to detect it

Review web server and application logs for redirect responses containing multiple consecutive backslashes followed by external domains; inspect authentication flow logs for unusual redirect parameter values.

• redirect=\\\\
• get_post_login_redirect.*\\\\
• get_post_logout_redirect.*\\\\

What your security team should do

• Apply the listed upstream commits immediately given public exploit availability
• Audit all redirect-handling code for similar validation bypass patterns
• Add runtime allow-list enforcement for post-login and post-logout redirects
• Monitor EPSS trend and re-evaluate if exploitation increases