CVE-2021-23384: Open Redirect in koa-remove-trailing-slashes
Summary
CVE-2021-23384: Open Redirect in koa-remove-trailing-slashes. Affects koa-remove-trailing-slashes versions < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package koa-remove-trailing-slashes is an npm package that provides functionality to remove trailing slashes from URLs in Koa web applications. It is commonly used to ensure consistent URL formatting and improve SEO. However, versions before 2.0.2 are vulnerable to an Open Redirect vulnerability. This vulnerability allows an attacker to redirect users to malicious websites by exploiting the use of trailing double slashes in the URL. The vulnerable code is located in index.js::removeTrailingSlashes(), where the web server uses relative URLs instead of absolute URLs.
Vulnerability Detail
The Open Redirect vulnerability in koa-remove-trailing-slashes allows an attacker to craft a URL with trailing double slashes (e.g., https://example.com//attacker.example/) to redirect users to a malicious website. By taking advantage of the relative URL handling in the vulnerable code, an attacker can bypass URL validation and trick users into visiting a URL that appears legitimate but leads to a malicious destination. This can result in various attacks, such as phishing, malware distribution, or further exploitation of the user's system.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
npm install koa-remove-trailing-slashes@2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
The Open Redirect vulnerability in koa-remove-trailing-slashes can lead to malicious redirection of users to harmful websites. It is crucial to update the package to version 2.0.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for koa-remove-trailing-slashes →
FAQ
An Open Redirect vulnerability allows an attacker to redirect users from a legitimate website to a malicious one. It occurs when a web application accepts user-supplied input to construct a redirect URL without proper validation or sanitization.
An Open Redirect vulnerability can be exploited for various malicious purposes, including phishing attacks, malware distribution, and further exploitation of the user's system. It can trick users into visiting a seemingly legitimate URL that leads to a malicious website.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json to analyze the software without requiring access to the code or installation.
Yes, a fix is available for this vulnerability. It is recommended to update the koa-remove-trailing-slashes package to version 2.0.2 or later. This version includes a fix for the Open Redirect vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-r773-pmw3-f4mr/GHSA-r773-pmw3-f4mr.json
