GitHub Advisoryadvisory · PyPI

GHSA-g839-x3p3-g5fm CodeChecker open redirect when URL contains multiple slashes after the product name

MEDIUM Published 2025-03-03 Modified 2025-03-03 Official page ↗
Aliases
CVE-2025-1300
Ecosystem
PyPI
Packages
codechecker
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2025-03-03

Affected packages

• PyPI codechecker: < 6.24.6 → fixed in 6.24.6

Description

Summary --- CodeChecker versions up to 6.24.5 contain an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL's path segment. This results in bypassing protections against CVE-2021-28861, leading to the same open redirect pathway. Details --- CodeChecker processes GET requests by first rewriting the path segment of the URL, and then passing the rewritten URL to the webserver framework. When trimming the product name from the URL, no sanitization was performed on the remaining URL, which reintroduced the same issue as CVE-2021-28861, leading to the same open redirect pathway using URLs such as `/Default//attacker.com/%2f..`. Impact --- The vulnerability allows an attacker to create a hyperlink that looks like a legitimate CodeChecker URL, but redirects to an attacker-supplied website when clicked.

Related

Alias · CVE (1)

  • CVE-2025-1300 CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References