Executive brief
ecstatic is a popular Node.js static file-serving module used by many web applications. An open redirect vulnerability in the module allows attackers to craft malicious URLs that deceive users into visiting attacker-controlled destinations, potentially leading to phishing or credential theft attacks.
Technical details
The vulnerability is an open redirect flaw in ecstatic's request handling logic. The exact root cause involves insufficient validation of redirect paths, allowing an attacker to craft URLs that cause the application to redirect users to external attacker-controlled sites. The attack requires only network access and a crafted URL—no authentication or user interaction beyond clicking a link is needed. An attacker can exploit this to redirect legitimate users from a trusted source to a malicious site for phishing or malware distribution. The issue was fixed in versions 2.2.2 (for 0–2.x track), 3.3.2 (for 3.x track), and 4.1.2 (for 4.x track).
Affected products
- ecstatic ecstatic < 2.2.2; 3.0.0 - < 3.3.2; 4.0.0 - < 4.1.2
Timeline
- 2020-08-19: disclosed