Executive brief
Follow Redirects is a popular Node.js library used by many applications to manage HTTP redirects. The library improperly handles certain malformed URLs, allowing attackers to spoof the destination hostname. An attacker could trick users into visiting malicious websites through crafted redirect chains, potentially resulting in phishing, information theft, or other social engineering attacks.
Technical details
This vulnerability is an improper input validation flaw (CWE-20, CWE-601 - open redirect) in the follow-redirects library versions before 1.15.4. The root cause is the mishandling of URLs by the url.parse() function, specifically when new URL() throws an error. An attacker can craft a malformed URL that causes the error handler to misinterpret the hostname, redirecting traffic to an attacker-controlled domain. The attack requires user interaction (clicking a malicious link) and is delivered over the network. The patch was released in version 1.15.4 with commit 7a6567e16dfa9ad18a70bfe91784c28653fbf19d.
Affected products
- follow-redirects follow-redirects < 1.15.4
Timeline
- 2024-01-02: disclosed: Vulnerability published via GHSA-jchw-25xp-jwwc
- 2024-01-02: patched: Fixed in version 1.15.4