CVE-2023-26159
📋 TL;DR
This vulnerability in follow-redirects package allows attackers to manipulate URL parsing errors to redirect traffic to malicious sites. It affects applications using follow-redirects versions before 1.15.4 for HTTP/HTTPS requests. The vulnerability enables potential phishing attacks, information disclosure, and other security breaches.
💻 Affected Systems
- follow-redirects npm package
📦 What is this software?
Follow Redirects by Follow Redirects
⚠️ Risk & Real-World Impact
Worst Case
Complete traffic hijacking to attacker-controlled servers leading to credential theft, session hijacking, and malware distribution.
Likely Case
Phishing attacks where users are redirected to malicious sites that mimic legitimate services to steal credentials.
If Mitigated
Limited impact with proper input validation and monitoring, potentially catching redirect anomalies.
🎯 Exploit Status
Exploitation requires the ability to control URL inputs to applications using follow-redirects. Public proof-of-concept demonstrates the manipulation technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15.4 and later
Vendor Advisory: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-74fj-2j2h-c42q
Restart Required: Yes
Instructions:
1. Update package.json to specify follow-redirects version 1.15.4 or higher. 2. Run 'npm update follow-redirects' or 'yarn upgrade follow-redirects'. 3. Restart your Node.js application. 4. Test that URL redirect functionality still works correctly.
🔧 Temporary Workarounds
Input Validation Workaround
allImplement strict URL validation before passing to follow-redirects
// JavaScript example: Validate URLs before use
const url = require('url');
function validateURL(inputURL) {
try {
const parsed = new URL(inputURL);
// Add additional validation logic here
return parsed;
} catch (e) {
throw new Error('Invalid URL');
}
}
🧯 If You Can't Patch
- Implement strict input validation for all URL parameters before they reach follow-redirects
- Monitor and log all redirects for anomalies, especially to unexpected domains
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list follow-redirects' to see installed version. If version is below 1.15.4, you are vulnerable.Check Version:
npm list follow-redirects | grep follow-redirectsVerify Fix Applied:
After updating, run 'npm list follow-redirects' to confirm version 1.15.4 or higher is installed. Test URL redirect functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected redirects to unfamiliar domains
- URL parsing errors followed by redirects
- Multiple failed URL validations
Network Indicators:
- HTTP redirects to suspicious domains
- Unusual outbound connections from application servers
SIEM Query:
source="application_logs" AND ("redirect" OR "URL.parse") AND (error OR suspicious)🔗 References
- https://github.com/follow-redirects/follow-redirects/issues/235
- https://github.com/follow-redirects/follow-redirects/pull/236
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/
- https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137
- https://github.com/follow-redirects/follow-redirects/issues/235
- https://github.com/follow-redirects/follow-redirects/pull/236
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/
- https://security.netapp.com/advisory/ntap-20241108-0002/
- https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137
