CVE-2021-3189: Open redirect in Slashify
Summary
CVE-2021-3189: Open redirect in Slashify. Affects slashify versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Slashify is an Express middleware package that normalizes routes by removing any trailing slashes. It is commonly used in Node.js applications to ensure consistent URL patterns. However, the package is vulnerable to an open redirect issue, which can lead to unauthorized redirects to different domains. This vulnerability affects versions 0.0.0 to 1.0.0 of the slashify package.
Vulnerability Detail
The open redirect vulnerability in slashify arises from the package's failure to validate the path it redirects to. When a path starts with two slashes or a combination of slashes and backslashes, it may redirect the user to a different domain. For example, visiting localhost:3000///github.com/ while running a server with slashify middleware will redirect the user to https://github.com. This can be exploited by an attacker to trick users into visiting malicious websites or phishing pages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no known safe version of slashify, there is no direct workaround for this vulnerability. However, developers can mitigate the risk by manually validating and sanitizing the paths before performing any redirects. This can be achieved by implementing custom middleware or using other well-maintained middleware packages that do not suffer from this vulnerability.
Conclusion
The open redirect vulnerability in slashify can lead to unauthorized redirects to different domains, potentially exposing users to phishing attacks or other malicious activities. Discontinuing the use of slashify and finding alternative middleware packages is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for slashify →
FAQ
Slashify is an Express middleware package used to normalize routes by removing trailing slashes.
An open redirect vulnerability allows an attacker to redirect users to a different domain or URL, potentially leading to phishing attacks or other malicious activities.
By crafting a URL with multiple slashes at the beginning, an attacker can trick the slashify middleware into redirecting the user to a different domain.
Currently, there is no known safe version of the slashify package that addresses this vulnerability. Discontinuing the use of slashify is recommended.
Yes, developers can consider using other well-maintained middleware packages that provide similar functionality without the open redirect vulnerability.
