Executive brief
ecstatic is a static file server library used in Node.js applications. Versions prior to 4.1.2, 3.3.2, or 2.2.2 fail to validate HTTP redirect destinations, allowing an attacker to craft requests that redirect users to arbitrary external websites. This can be used for phishing attacks or credential harvesting.
Technical details
The vulnerability is an open redirect (CWE-601) in ecstatic's HTTP redirect handling. The package fails to validate or sanitize redirect targets, allowing attackers to craft requests that result in HTTP 301 redirects to any external domain. An attacker can exploit this by crafting a malicious URL pointing to an ecstatic-served application and specifying an arbitrary redirect target. No special authentication is required; the attack is network-accessible and can trick users into visiting attacker-controlled sites. Patches are available: upgrade to version 4.1.2 (for 4.x), 3.3.2 (for 3.x), or 2.2.2 (for 2.x).
Affected products
- ecstatic ecstatic before 2.2.2, 3.0.0 to before 3.3.2, 4.0.0 to before 4.1.2
Timeline
- 2020-04-01: disclosed