~ / search / GHSA-r773-pmw3-f4mr

GHSA-r773-pmw3-f4mr

Open Redirect in koa-remove-trailing-slashes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23384

Packages

EcosystemPackageAffectedFixed in
npm koa-remove-trailing-slashes < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as `https://example.com//attacker.example/`). The vulnerable code is in `index.js::removeTrailingSlashes()`, as the web server uses relative URLs instead of absolute URLs.

References

External links from the advisory. They lead to third-party sites.