Improper Input Validation Affecting follow-redirects package, versions <1.15.4
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (19th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-FOLLOWREDIRECTS-6141137
- published 1 Jan 2024
- disclosed 31 Dec 2023
- credit Kim Donggyu
Introduced: 31 Dec 2023
CVE-2023-26159 Open this link in a new tabHow to fix?
Upgrade follow-redirects to version 1.15.4 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
PoC
# Case 1 : Bypassing localhost restriction
let url = 'http://[localhost]/admin';
try{
new URL(url); // ERROR : Invalid URL
}catch{
url.parse(url); // -> http://localhost/admin
}
# Case 2 : Bypassing domain restriction
let url = 'http://attacker.domain*.allowed.domain:a';
try{
new URL(url); // ERROR : Invalid URL
}catch{
url.parse(url); // -> http://attacker.domain/*.allowed.domain:a
}