Executive brief
The trailing-slash npm package is a Node.js utility that normalizes URLs by managing trailing slashes. Versions before 2.0.1 contain an open redirect vulnerability that allows attackers to craft malicious URLs with double slashes to redirect users to arbitrary external websites. This could be exploited to perform phishing attacks or direct users to malicious content.
Technical details
The vulnerability is a CWE-601 open redirect flaw in the createTrailing() function within index.js. The vulnerable code uses relative URLs instead of absolute URLs when processing URLs with trailing double slashes (e.g., https://example.com//attacker.example/). An unauthenticated attacker can craft a malicious URL and trick users into clicking it; the web server then redirects the victim to an arbitrary external domain. The vulnerability affects all versions before 2.0.1, which was patched in the commit f8e66f1.
Affected products
- fardog trailing-slash before 2.0.1
Timeline
- 2021-05-24: disclosed: NVD publication date
- 2021-06-08: patched: Version 2.0.1 released with fix