Listen to this Post
How the CVE Works
The Koa framework’s `response.redirect()` method allows a “back” keyword that uses the `Referer` header for redirection. Since the `Referer` header is user-controlled, an attacker can manipulate it to redirect victims to malicious sites. The insecure implementation in `back (alt)` directly uses `this.ctx.get(‘Referrer’)` without validation, leading to open redirects. For example, sending a request with `Referer: http://evil.com` causes the server to redirect to the attacker’s domain.
DailyCVE Form
Platform: Koa
Version: Latest
Vulnerability: Open Redirect
Severity: Critical
Date: 2023-10-15
Prediction: Patch by 2023-11-10
What Undercode Say
curl -H "Referer: http://evil.com" http://victim-site/test
ctx.redirect('back'); // Vulnerable code
How Exploit
1. Attacker crafts malicious `Referer` header.
2. Victim clicks manipulated link.
3. Server redirects to attacker’s domain.
Protection from this CVE
- Disable `back` redirects.
- Validate `Referer` header.
- Use fixed Koa version.
Impact
- Phishing attacks.
- Session hijacking.
- Malware distribution.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
