Executive brief
The call library, a routing module used to handle HTTP request paths, fails to validate empty route parameters. An attacker can craft malicious URLs with empty path segments to bypass intended route validation rules, potentially accessing restricted API endpoints or triggering unintended application behavior.
Technical details
The vulnerability is an input validation flaw (CWE-20) in the call routing library. The root cause is insufficient validation of empty parameters in route matching logic. An attacker can bypass route validation rules by sending requests with empty path segments (e.g., /api/// against a defined route /api/{param}/{param2}/details). This is a network-level attack requiring no authentication. The impact is bypass of route-based access controls. The vulnerability was fixed in version 3.0.2; affected versions are 2.0.1 through 3.0.1.
Affected products
- npm call 2.0.1 to 3.0.1
Timeline
- 2016-07: disclosed: Issue opened on GitHub
- 2016: patched: Fixed in version 3.0.2
- 2019-02-18: advisory: GitHub Advisory published