| Package | Affected versions | Patched versions |
|---|---|---|
| react-router | ≥ 7.2.0, < 7.5.2 | 7.5.2 |
After some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application.
The vulnerable header is X-React-Router-SPA-Mode; adding it to a request sent to a page/endpoint using a loader throws an error. Here is the vulnerable code :
To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.
Versions used for our PoC:
routes/ssr)/ssr in our case) adding the following header:X-React-Router-SPA-Mode: yes
Notice the difference between a request with and without the header;
Normal request
With the header
If a system cache is in place, it is possible to poison the response by completely altering its content (by an error message), strongly impacting its availability, making the latter impractical via a cache-poisoning attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free