CVE-2024-27291: 
Python vulnerability analysis and mitigation

Docassemble, an expert system for guided interviews and document assembly, was found to contain an open redirect vulnerability in versions prior to 1.4.97. The vulnerability was discovered by Riyush Ghimire and disclosed on February 29, 2024. The issue allowed attackers to create URLs that could act as open redirects (GitHub Advisory).

The vulnerability has been assigned CVE-2024-27291 and received a CVSS v3.1 base score of 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The issue is classified as CWE-601 (URL Redirection to Untrusted Site). The vulnerability allowed the creation of URLs that could perform open redirects, potentially leading to phishing attacks or other malicious redirections (NVD).

The vulnerability could allow attackers to create malicious URLs that redirect users to untrusted sites. This could be exploited in phishing attacks or other social engineering attempts to direct users to malicious websites while appearing to come from a trusted Docassemble instance (GitHub Advisory).

The vulnerability requires no special privileges to exploit, though it does require user interaction. The attack vector is network-accessible and can be executed with low attack complexity (NVD).

The vulnerability has been patched in version 1.4.97 of Docassemble. Users are recommended to upgrade to this version as soon as possible. For those unable to upgrade immediately, a manual workaround is available by applying the changes from commit 4801ac7 and restarting the server through the Configuration screen (GitHub Advisory).