| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| @saltcorn/server | ≥ 1.5.0-beta.0, < 1.5.6≥ 1.6.0-alpha.0, < 1.6.0-beta.5< 1.4.6 | 1.5.61.6.0-beta.51.4.6 |
Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL.
Vulnerable function: packages/server/routes/utils.js:393-395
const is_relative_url = (url) => {
return typeof url === "string" && !url.includes(":/") && !url.includes("//");
};
The function's intent is to allow only same-origin redirects, but the allow-list only checks for two literal substrings. It does not handle:
http, https, ftp, ws, wss. A URL parser fed /\evil.com/path with a base of http://victim/ resolves to http://evil.com/path.http(s): schemes that do not contain :/. The strings javascript:alert(1), data:text/html,..., vbscript:... all pass.Vulnerable callsite: packages/server/auth/routes.js:1371-1376
} else if (
(req.body || {}).dest &&
is_relative_url(decodeURIComponent((req.body || {}).dest))
) {
res.redirect(decodeURIComponent((req.body || {}).dest));
} else res.redirect("/");
The body's dest is URL-decoded twice (once by body-parser, once by the explicit decodeURIComponent) and the same value is passed to res.redirect. Express 5's res.redirect runs the value through [email protected], whose whitelist character class [^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E] includes \x5C (backslash). The backslash is therefore not percent-encoded and ends up verbatim in the Location response header.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíPlease extract the uploaded compressed file before proceeding
Any user who can be lured into clicking a Saltcorn login URL crafted by the attacker will, after submitting their valid credentials, be redirected to an attacker-controlled origin. The redirect happens under the trusted Saltcorn domain, so the user has no visual cue that they are about to leave the site. Realistic abuse patterns: