Executive brief
Karma is a test runner for JavaScript projects. The test runner fails to validate URLs in the return_url parameter, allowing attackers to craft links that redirect users to arbitrary external websites after a test run completes. This can be used in phishing attacks or to direct users to malicious content.
Technical details
This is a CWE-601 (Open Redirect) vulnerability in Karma before version 6.3.16. The root cause is insufficient validation of the return_url query parameter; the original check using /^https?:\/\// only verified that the URL started with http:// or https://, but did not prevent protocol-relative URLs (//example.com) or other open redirect techniques. The vulnerability is network-reachable and requires user interaction (clicking a malicious link with a crafted return_url parameter). An attacker can redirect users to arbitrary external sites after a test suite completes. The vulnerability was patched in version 6.3.16 by implementing an allowedReturnUrlPatterns whitelist configuration to validate URLs against approved patterns.
Affected products
- karma-runner Karma before 6.3.16
Timeline
- 2022-02-26: disclosed
- 2022-02-10: patched: Fix commit ff7edbb available on 2022-02-10