Open Redirect Affecting node-static package, versions *
Snyk CVSS
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NODESTATIC-1297184
- published 28 May 2021
- disclosed 28 May 2021
- credit Unknown
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching.
Affected versions of this package are vulnerable to Open Redirect. The package fails to sanitize URLs and may redirect users to domains passed through the URL. The possible redirect domains are restricted to hosts whose name matches a served folder from the application. For example if the application serves the folder ./public and has a folder ./public/example.com, accessing localhost:8080//example.com redirects to https://www.example.com/.