GitHub Advisoryadvisory · npm

GHSA-c3x7-gjmx-r2ff Open Redirect in serve-static

LOW Published 2020-08-31 Modified 2021-09-23 Official page ↗
Aliases
CVE-2015-1164
Ecosystem
npm
Packages
serve-static
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2020-08-31

Affected packages

• npm serve-static: < 1.7.2 → fixed in 1.7.2 • npm serve-static: >= 1.7.0, < 1.7.2 → fixed in 1.7.2

Description

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory. Proof of Concept A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e` Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect. Recommendation Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.

Related

Alias · CVE (1)

  • CVE-2015-1164 Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References