GitHub Advisoryadvisory · npm
GHSA-84fv-prrc-5ggr Route Validation Bypass in call
MEDIUM
Official page ↗
- Aliases
- CVE-2016-10543
- Ecosystem
- npm
- Packages
- call
- Severity
- Moderate
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• npm call: >= 2.0.1, < 3.0.2 → fixed in 3.0.2
Description
Affected versions of `call` do not validate empty parameters, which may result in a bypass of route validation rules.
Proof of Concept
Routing Scheme:
```
/api/{param}/{param2}/details
```
Triggering Request Path:
```
/api///
```
Recommendation
Update to version 3.0.2 or later.
Related
Alias · CVE (1)
- CVE-2016-10543 call is an HTTP router that is primarily used by the hapi framework. vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness