CVE-2023-26159: follow-redirects improper URL handling in url.parse()

CVE-2023-26159 · Severity: low · CVSS 3.1 · Published 2024-01-02

Follow Redirects is a popular Node.js library used by many applications to manage HTTP redirects. The library improperly handles certain malformed URLs, allowing attackers to spoof the destination hostname. An attacker could trick users into visiting malicious websites through crafted redirect chains, potentially resulting in phishing, information theft, or other social engineering attacks.

Technologies: follow-redirects (npm). Vendors: npm.

Quick answers

Is CVE-2023-26159 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-26159 being exploited in the wild.
How severe is CVE-2023-26159?
Low severity, with a CVSS score of 3.1, published 2 January 2024.
Which products and versions are affected?
follow-redirects (npm) SEMVER:introduced=0,fixed=1.15.4.
Is there a fix for CVE-2023-26159?
Yes. follow-redirects (npm): upgrade to 1.15.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26159 attacked?
It is attacked over the network.
Am I affected by CVE-2023-26159?
Check whether you run follow-redirects (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • follow-redirects (npm): upgrade to 1.15.4 or later
    npm install follow-redirects@1.15.4

Technical details

This vulnerability is an improper input validation flaw (CWE-20, CWE-601 - open redirect) in the follow-redirects library versions before 1.15.4. The root cause is the mishandling of URLs by the url.parse() function, specifically when new URL() throws an error. An attacker can craft a malformed URL that causes the error handler to misinterpret the hostname, redirecting traffic to an attacker-controlled domain. The attack requires user interaction (clicking a malicious link) and is delivered over the network. The patch was released in version 1.15.4 with commit 7a6567e16dfa9ad18a70bfe91784c28653fbf19d.

Affected products

  • follow-redirects follow-redirects < 1.15.4

Identifiers

  • CVE-2023-26159
  • GHSA-jchw-25xp-jwwc

Timeline

  • 2024-01-02: disclosed: Vulnerability published via GHSA-jchw-25xp-jwwc
  • 2024-01-02: patched: Fixed in version 1.15.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.