CVE-2025-32379
📋 TL;DR
This vulnerability in Koa.js allows cross-site scripting (XSS) attacks when untrusted user input is passed to ctx.redirect() function, even after sanitization. Attackers can execute arbitrary JavaScript code in victims' browsers when they visit maliciously crafted redirect URLs. This affects all applications using vulnerable versions of Koa.js middleware.
💻 Affected Systems
- Koa.js
📦 What is this software?
Koa by Koajs
Koa by Koajs
Koa by Koajs
Koa by Koajs
Koa by Koajs
Koa by Koajs
⚠️ Risk & Real-World Impact
Worst Case
Attackers can steal session cookies, perform actions as authenticated users, redirect to phishing sites, or install malware via drive-by downloads.
Likely Case
Session hijacking, credential theft, and client-side data exfiltration from users who click on malicious links.
If Mitigated
Limited impact with proper input validation and Content Security Policy headers, though vulnerability still exists at framework level.
🎯 Exploit Status
Exploitation requires user interaction (clicking a link) but is trivial to weaponize in phishing campaigns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.16.1 or 3.0.0-alpha.5
Vendor Advisory: https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v
Restart Required: Yes
Instructions:
1. Update package.json to require koa >=2.16.1 or >=3.0.0-alpha.5. 2. Run 'npm update koa' or 'yarn upgrade koa'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Input validation wrapper
allCreate a wrapper function that validates redirect URLs before passing to ctx.redirect()
// Example wrapper function
const safeRedirect = (ctx, url) => {
if (!url.startsWith('/') && !url.startsWith('http://') && !url.startsWith('https://')) {
throw new Error('Invalid redirect URL');
}
return ctx.redirect(url);
}
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to limit script execution
- Add server-side validation for all redirect URLs, rejecting any containing JavaScript schemes
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list koa' to see installed versionCheck Version:
npm list koa | grep koaVerify Fix Applied:
Confirm version is >=2.16.1 or >=3.0.0-alpha.5 using 'npm list koa'📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in access logs
- Redirects to JavaScript: or data: URIs
Network Indicators:
- HTTP 302/303 responses with JavaScript in Location header
SIEM Query:
http.status_code IN (302, 303) AND http.location CONTAINS "javascript:"