Executive brief
hekto is a static site generator that processes HTML files. The vulnerability allows an attacker to craft a malicious filename containing a domain name that causes the application to redirect users to an arbitrary external website, potentially leading to phishing attacks or credential theft.
Technical details
hekto versions before 0.2.4 are vulnerable to an open redirect vulnerability (CWE-601) when a domain name is used as part of a .html filename. The vulnerability occurs because the application fails to properly validate or sanitize filenames before using them in redirect operations. An attacker can craft a filename containing a target domain that, when processed by hekto, causes the application to redirect users to the attacker's website. The vulnerability requires user interaction (following a link) and network-accessible content. The fix was implemented in version 0.2.4.
Affected products
- herber hekto before 0.2.4
Timeline
- 2018-06-01: disclosed
- 2018-04-12: patched: fix merged in PR #3
- 2018-07-18: advisory