CVE-2019-19703: URL Redirection to Untrusted Site in Ktor
Summary
CVE-2019-19703: URL Redirection to Untrusted Site (Open Redirect) in Ktor. Affects io.ktor:ktor-client-core versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ktor is a framework for building asynchronous servers and clients in connected systems using Kotlin programming language. It provides a set of APIs for creating web applications, HTTP clients, and more. The Ktor client library, specifically the 'ktor-client-core' package, is affected by a URL redirection vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2019-19703, allows an attacker to redirect a user to an untrusted website by manipulating the HTTP Authorization header. This can lead to various attacks, such as phishing, where the user is tricked into visiting a malicious site that appears legitimate. The vulnerability exists in Ktor versions up to 1.2.6.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate and sanitize the redirect URL before performing the redirection. This can be done by checking if the URL belongs to a trusted domain or using a whitelist of allowed redirect URLs. Here's an example in Kotlin:
fun isRedirectUrlSafe(url: String): Boolean {
val trustedDomains = listOf("example.com", "trusteddomain.com")
val parsedUrl = URL(url)
return trustedDomains.contains(parsedUrl.host)
}
Before redirecting, you can call the isRedirectUrlSafe function to ensure the URL is safe to redirect to.
Conclusion
In conclusion, the URL redirection vulnerability in Ktor's 'ktor-client-core' package (CVE-2019-19703) can be mitigated by upgrading to version 1.3.0 or later. It is recommended to promptly update the affected package in your project to ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.ktor:ktor-client-core →
FAQ
Ktor is a framework for building asynchronous servers and clients in connected systems using Kotlin programming language. It provides a set of APIs for creating web applications, HTTP clients, and more.
The 'ktor-client-core' package is a component of the Ktor framework that provides functionality for making HTTP requests as a client. It is used to interact with external APIs, web services, and other HTTP-based resources.
URL redirection is a technique used to redirect a user from one web page to another. It is commonly used for various purposes, such as redirecting users to a different page after login or redirecting from HTTP to HTTPS.
The URL redirection vulnerability in Ktor can be exploited by attackers to redirect users to malicious websites. This can lead to phishing attacks, where users are tricked into entering sensitive information on fake websites that appear legitimate. It can also be used for other types of attacks, such as spreading malware or conducting further targeted attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file as input.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
