An open redirect was identified in the admin site of the Owid Grapher. This allows an attacker to redirect a victim to an arbitrary website.
The vulnerable code is shown here:
|
// Prevents redirect to external URLs |
|
let redirectTo = "/admin" |
|
if (req.query.next) { |
|
try { |
|
redirectTo = new URL(req.query.next as string, ADMIN_BASE_URL) |
|
.pathname |
|
} catch (err) { |
|
console.error(err) |
|
} |
|
} |
|
return res.redirect(redirectTo) |
The code is meant to prevent the accessing of arbitrary URLs, however, an attacker can bypass this by using the following payload
?next=C:http://attacker.com
This URL is seen as a valid URL and the pathname is set to http://attacker.com, which means the last line becomes res.redirect('http://attacker.com').
PinkDraconian Reporter
An open redirect was identified in the admin site of the Owid Grapher. This allows an attacker to redirect a victim to an arbitrary website.
The vulnerable code is shown here:
owid-grapher/adminSiteServer/authentication.ts
Lines 106 to 116 in bd7a70e
The code is meant to prevent the accessing of arbitrary URLs, however, an attacker can bypass this by using the following payload
This URL is seen as a valid URL and the
pathnameis set tohttp://attacker.com, which means the last line becomesres.redirect('http://attacker.com').