Executive brief
hekto is a Node.js utility library used for URL processing and HTML file serving. An open redirect vulnerability allows an attacker to craft a malicious URL that, when a user clicks it, redirects them to an arbitrary external domain. This can be exploited for phishing attacks or credential harvesting by making the redirect appear to come from a trusted application.
Technical details
The vulnerability is an open redirect flaw in hekto that occurs when a target domain name is used as an HTML filename on the server. The library fails to properly validate redirect destinations, allowing attackers to inject arbitrary URLs. An attacker can craft a specially formed URL that causes hekto to redirect users to malicious external sites. The vulnerability affects all versions prior to 0.2.4, which contains the fix. No authentication or special preconditions are required to exploit this vulnerability.
Affected products
- herber hekto before 0.2.4
Timeline
- 2020-08-27: disclosed
- 2018-04-12: patched: Fix merged in PR #3