Weblate Redirect Bypass Vulnerability in ALLOWED_ASSET_DOMAINS Setting

A vulnerability exists in Weblate, a web-based localization tool, in versions prior to 5.17. The issue lies in the handling of the ALLOWED_ASSET_DOMAINS setting, which only applied to the initial request and failed to properly restrict redirects. This flaw could be exploited to bypass domain restrictions, potentially leading to an authenticated server-side request forgery (SSRF) vulnerability during screenshot URL uploads.

Impact

Exploitation of this vulnerability could allow authenticated users to bypass domain restrictions, leading to unauthorized redirects and potential SSRF attacks.

Reproduction

To reproduce this vulnerability, upload a screenshot via a URL that redirects from a domain not included in the ALLOWED_ASSET_DOMAINS setting. The upload will be accepted, and the redirect will not be blocked, demonstrating the bypass.

Remediation

Users can update to Weblate version 5.17 or later, where this issue has been fixed.