CVE-2022-0637: 
Python vulnerability analysis and mitigation

An open redirect vulnerability was discovered in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6. The vulnerability allowed attackers to construct URLs within the application that could cause redirection to arbitrary external domains (Mozilla Bugzilla, CVE Mitre).

The vulnerability existed when the application incorporated user-controllable data into the target of a redirection in an unsafe way. Specifically, by replacing '/v1/' with '/%0a/evil.com/projectX.htm/' in the URL, an attacker could cause the application to redirect users to malicious domains. The issue was reproducible on both pollbot.services.mozilla.com and pollbot.stage.mozaws.net (Mozilla Bugzilla).

The vulnerability could be leveraged to facilitate phishing attacks against users of the application. Since the initial URL was legitimate with a valid SSL certificate, it lent credibility to potential phishing attacks. Attackers could redirect victims to malicious sites, deliver malware, or create phishing pages that could steal user credentials while appearing to come from a trusted Mozilla domain (Mozilla Bugzilla).

The vulnerability was fixed in pollbot version 1.4.6 and deployed to both pollbot.stage.mozaws.net and pollbot.services.mozilla.com (Mozilla Bugzilla).