netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-x2rg-q646-7m2v

Browse Source
This commit is contained in:
advisory-database[bot]
2025-04-09 20:31:17 +00:00
parent 725df03e08
commit 85c87e6b78
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/04/GHSA-x2rg-q646-7m2v/GHSA-x2rg-q646-7m2v.json
+7 -3
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x2rg-q646-7m2v",
"modified": "2025-04-09T13:00:07Z",
"modified": "2025-04-09T20:29:43Z",
"published": "2025-04-09T13:00:07Z",
"aliases": [
"CVE-2025-32379"
],
"summary": "Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function",
"details": "### Summary\nIn koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.\n\n### Patches\nThis issue is patched in 2.16.1 and 3.0.0-alpha.5.\n\n### PoC\nhttps://gist.github.com/linhnph05/03d677b183636af206ff781bdd19701a\n\n### Impact\n1. Redirect user to another phishing site\n2. Make request to another endpoint of the application based on user's cookie\n3. Steal user's cookie",
"details": "### Summary\nIn koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.\n\n### Patches\nThis issue is patched in 2.16.1 and 3.0.0-alpha.5.\n\n### PoC\nComing soon...\n\n### Impact\n1. Redirect user to another phishing site\n2. Make request to another endpoint of the application based on user's cookie\n3. Steal user's cookie",
"severity": [
{
"type": "CVSS_V3",
@@ -59,6 +59,10 @@
"type": "WEB",
"url": "https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32379"
},
{
"type": "WEB",
"url": "https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe86355161067687312"
@@ -75,6 +79,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-09T13:00:07Z",
"nvd_published_at": null
"nvd_published_at": "2025-04-09T16:15:25Z"
}
}