Open Redirect Affecting node-forge package, versions <1.0.0
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NODEFORGE-2330875
- published 6 Jan 2022
- disclosed 6 Jan 2022
- credit ready-research
Introduced: 6 Jan 2022
CVE-2022-0122 Open this link in a new tabHow to fix?
Upgrade node-forge to version 1.0.0 or higher.
Overview
node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Affected versions of this package are vulnerable to Open Redirect via parseUrl function when it mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
PoC:
// poc.js
var forge = require("node-forge");
var url = forge.util.parseUrl("https:/\/\/\www.github.com/foo/bar");
console.log(url);
// Output of node poc.js:
{
full: 'https://',
scheme: 'https',
host: '',
port: 443,
path: '/www.github.com/foo/bar', <<<---- path should be "/foo/bar"
fullHost: ''
}