Executive brief
koa-remove-trailing-slashes is a Node.js middleware library that processes URLs in web applications. A flaw in the library allows attackers to craft URLs with double slashes that trigger open redirects to arbitrary external domains, potentially stealing user sessions or credentials when victims are tricked into clicking malicious links.
Technical details
The vulnerability is an open redirect (CWE-601) in the removeTrailingSlashes() function in index.js. The middleware constructs redirect URLs using relative URLs instead of absolute URLs, allowing an attacker to supply a URL like https://example.com//attacker.example/ that bypasses origin validation. The attack requires user interaction (clicking a link) and network reachability to the vulnerable web application. The fix ensures only redirects within the current origin are permitted. Versions prior to 2.0.2 are affected; a patch is available in version 2.0.2.
Affected products
- koa-remove-trailing-slashes koa-remove-trailing-slashes before 2.0.2
Timeline
- 2021-05-17: disclosed: NVD published
- 2021-05-19: patched: GitHub advisory reviewed
- 2022-02-10: advisory: GHSA published