| Package | Affected versions | Patched versions |
|---|---|---|
| flask-appbuilder | < 4.6.2 | 4.6.2 |
| flask-appbuilder | < 4.6.2 | 4.6.2 |
Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests.
Flask-AppBuilder 4.6.2 introduced the FAB_SAFE_REDIRECT_HOSTS configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection.
Examples:
FAB_SAFE_REDIRECT_HOSTS = ["yourdomain.com", "sub.yourdomain.com", "*.yourcompany.com"]
Use a Reverse Proxy to Enforce Trusted Host Headers
Are there any links users can visit to find out more?
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free