Listen to this Post
How the mentioned CVE works: In React Router and Remix v1/v2 applications using Framework Mode, Data Mode, or unstable RSC modes, loaders or actions can return redirect responses based on user input. If this input is untrusted and not properly validated, it can lead to open redirects. The router processes navigation client-side in single-page applications (SPAs), allowing crafted URLs to redirect to malicious sites. This occurs because user-controllable input is not neutralized before being placed in redirect URLs. Attackers can exploit this by tricking users into clicking malicious links that trigger the redirect. The vulnerable code paths involve functions like `redirect()` from React Router that accept unvalidated URLs. When the redirect is performed, it can execute unintended JavaScript on the client, potentially leading to cross-site scripting (XSS) or other attacks. This vulnerability is specific to programmatic navigation modes and does not affect Declarative Mode with <BrowserRouter>. The issue stems from improper input sanitization, allowing arbitrary URLs to be used in redirects. Developers who incorporate user-generated content into redirect paths are at risk. The open redirect can facilitate phishing attacks or client-side code execution. Mitigation requires validating and sanitizing all redirect URLs.
Platform: React Router Remix
Version: v1 v2
Vulnerability: Open redirect
Severity: Critical
Date: 2023-10-11
Prediction: Patched 2023-10-18
What Undercode Say:
Analytics:
npm list react-router-dom
npm list @remix-run/react
Code snippet:
import { redirect } from ‘react-router-dom’;
export async function loader({ request }) {
const url = new URL(request.url);
const redirectUrl = url.searchParams.get(‘redirect’);
return redirect(redirectUrl);
}
How Exploit:
Craft malicious URL with JavaScript payload in redirect parameter, trick user into clicking, execute client-side code via open redirect.
Protection from this CVE:
Validate redirect URLs, use allowlists, avoid untrusted input, switch to Declarative Mode, update to patched versions.
Impact:
Client-side JavaScript execution, cross-site scripting, phishing, unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
