📝 Description

The redirect get variable in login page isn't properly checked. Currently, it check if url.scheme and url.netloc are empty using urllib.

parsed = urlparse(redirect_url)  # check if redirect url is valid
if parsed.scheme != "" or parsed.netloc != "":
    _logger.warning(
        f"Got an invalid redirect URL with the login attempt, misconfiguration or attack attempt: {redirect_url}"
    )
    redirect_url = default_redirect_url

The problem here, is that urllib does not handle all url currently. For example:

>>> urlparse("\/mizu.re/")
ParseResult(scheme='', netloc='', path='\\/mizu.re/', params='', query='', fragment='')

As you can see, here url.scheme and url.netloc are empty and path is a valid URL. Knowing that, we can easly bypass the restriction.

🕵️‍♂️ Proof of Concept

• Step 1: start octoprint and go to http://localhost:5000/login?redirect=\/\/mizu.re/.

• Step 2: login.

Impact

An attacker could redirect a user to malicious domain, for example, it could be useful for phishing.