GitHub Advisoryadvisory · npm

GHSA-f4hq-453j-p95f Open redirect in Slashify

MEDIUM Published 2021-02-05 Modified 2022-05-26 Official page ↗
Aliases
CVE-2021-3189
Ecosystem
npm
Packages
slashify
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-02-05

Affected packages

• npm slashify: <= 1.0.0 (no fix yet)

Description

The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain. Consider the example from the docs. Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com. Recommendation This vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.

Related

Alias · CVE (1)

  • CVE-2021-3189 The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References