Open Redirect Affecting node-static package, versions *


0.0
medium
  • Attack Complexity

    Low

  • User Interaction

    Required

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JS-NODESTATIC-1297184

  • published

    28 May 2021

  • disclosed

    28 May 2021

  • credit

    Unknown

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching.

Affected versions of this package are vulnerable to Open Redirect. The package fails to sanitize URLs and may redirect users to domains passed through the URL. The possible redirect domains are restricted to hosts whose name matches a served folder from the application. For example if the application serves the folder ./public and has a folder ./public/example.com, accessing localhost:8080//example.com redirects to https://www.example.com/.

References