Clzoom

Authlib is a Python library used to build OAuth and OpenID Connect servers. The `OctKey.import key()` function and the HMAC signing and verification path accept zero-length key material. If an application's secret lookup returns an empty string or empty bytes, a remote attacker can compute deterministic HS256, HS384, or HS512 signatures for arbitrary token claims, leading the library to treat the token as authentic.

A logical flaw exists in the URL validation process that allows for Server-Side Request Forgery (SSRF). The ` is safe url()` function uses `urlparse` to validate remote media URLs, while `requests.Session().get` interprets backslashes differently when sending the request. An attacker can provide a specially crafted URL containing a backslash that causes `urlparse` to identify a globally routable hostname, while the actual request is routed to an internal host. This discrepancy allows attackers to bypass non-global address checks and induce applications to access internal HTTP services, potentially exposing sensitive data.

Custom Jinja2 include tags `mdsection include` and `md clean include` re-parse the content of included Markdown files as template code within a non-sandboxed environment. This allows server-side template injection (SSTI), a vulnerability where an attacker injects malicious template directives that are executed by the server, potentially leading to arbitrary code execution. The `MDSectionInclude` and `MDCleanInclude` tags in `Trestle/core/jinja/tags.py` pass file content to the `Parser(self.environment, ...).parse()` function using a standard `jinja2.Environment` instead of a `SandboxedEnvironment`. Consequently, attacker-controlled OSCAL data—such as control statements, part prose, or component descriptions—containing Jinja2 syntax is executed when the include tag re-parses the file.