Is CVE-2018-3743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3743 being exploited in the wild.

How severe is CVE-2018-3743?

Low severity, with a CVSS score of 3.1, published 18 July 2018.

Which products and versions are affected?

hekto (npm) SEMVER:introduced=0,fixed=0.2.4.

Is there a fix for CVE-2018-3743?

Yes. hekto (npm): upgrade to 0.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3743 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-3743?

Check whether you run hekto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3743: hekto open redirect in filename handling

CVE-2018-3743 · Severity: low · CVSS 3.1 · Published 2018-07-18

hekto is a static site generator that processes HTML files. The vulnerability allows an attacker to craft a malicious filename containing a domain name that causes the application to redirect users to an arbitrary external website, potentially leading to phishing attacks or credential theft.

Technologies: hekto (npm). Vendors: npm.

Quick answers

Is CVE-2018-3743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3743 being exploited in the wild.
How severe is CVE-2018-3743?: Low severity, with a CVSS score of 3.1, published 18 July 2018.
Which products and versions are affected?: hekto (npm) SEMVER:introduced=0,fixed=0.2.4.
Is there a fix for CVE-2018-3743?: Yes. hekto (npm): upgrade to 0.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3743 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-3743?: Check whether you run hekto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hekto (npm): upgrade to 0.2.4 or later
```
npm install hekto@0.2.4
```

Technical details

hekto versions before 0.2.4 are vulnerable to an open redirect vulnerability (CWE-601) when a domain name is used as part of a .html filename. The vulnerability occurs because the application fails to properly validate or sanitize filenames before using them in redirect operations. An attacker can craft a filename containing a target domain that, when processed by hekto, causes the application to redirect users to the attacker's website. The vulnerability requires user interaction (following a link) and network-accessible content. The fix was implemented in version 0.2.4.

Affected products

herber hekto before 0.2.4

Identifiers

CVE-2018-3743
GHSA-qmm9-x5gr-4gfm

Timeline

2018-06-01: disclosed
2018-04-12: patched: fix merged in PR #3
2018-07-18: advisory

References

https://github.com/herber/hekto/pull/3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.