WebOb's location header normalization during redirect leads to open redirect

Vulnerability

WebOb's _make_location_absolute function normalizes HTTP Location headers by parsing the redirect URL with Python's urlparse and joining it to the request base URL using urljoin. However, urlparse treats a string starting with // as a protocol-relative URI, interpreting the next segment as the hostname. When urljoin combines this with the base URL, it replaces the original hostname with the attacker-controlled hostname, resulting in an open redirect [1][3].

Exploitation

An attacker can exploit this by crafting a response with a Location header beginning with //attacker.com/path. When WebOb normalizes this header, the redirect target becomes https://attacker.com/path instead of the intended domain. No authentication is required; the attacker only needs to influence the redirect location, for example by providing a malicious URL that the application uses in a redirect [3].

Impact

Successful exploitation allows an attacker to redirect users to an arbitrary external site. This can be leveraged for phishing attacks, bypassing security controls that rely on the redirect destination, or directing users to malicious content [3].

Mitigation

The vulnerability is patched in WebOb version 1.8.8. The fix prepends /%2f to the path when the location starts with //, preventing hostname replacement [4]. Users should upgrade to 1.8.8 or later. As a workaround, applications can ensure that all redirect locations are provided as full URIs including the scheme and hostname [3].