Executive brief
Apostrophe is an open-source Node.js content management framework. Versions prior to 2.92.0 contain an open redirect vulnerability that allows attackers to redirect users to arbitrary external websites by crafting specially-formatted URLs. An attacker could trick users into following malicious links that redirect them to phishing sites or other malicious destinations.
Technical details
The vulnerability is a CWE-601 open redirect flaw in Apostrophe's URL handling logic. The root cause lies in improper validation of URL slugs: the application's trailing-slash remover would redirect to the un-escaped version of a slug when an escaped URL followed by a trailing slash was appended. The attack is network-accessible and requires no authentication, only that a user follows a crafted link. An attacker can cause the application to redirect users to third-party websites. The fix removes all multiple-slash sequences from the slug part of URLs. A patch was released in version 2.92.0.
Affected products
- ApostropheCMS Apostrophe prior to 2.92.0
Timeline
- 2020-09-03: disclosed