| Package | Affected versions | Patched versions |
|---|---|---|
| terriajs-server | < 4.0.3 | 4.0.3 |
| terriajs-server | < 4.0.3 | 4.0.3 |
A validation bug allows an attacker to proxy domains not explicitly allowed in the proxyableDomains configuration.
The validation only checks if a hostname ended with an allowed domain. This meant:
If example.com is allowed in proxyableDomains:
An attacker could register maliciousexample.com and proxy content through terriajs-server, bypassing proxy restrictions.
All versions up to 4.0.2 are affected. Upgrade to 4.0.3 to address the vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free