LowGHSA-c3x7-gjmx-r2ffCVE-2015-1164

Open Redirect in serve-static

Published 31 Aug 2020 · Updated 8 Nov 2023

Affected packages

serve-staticnpm
Affected
<1.7.2
Fixed in
1.7.2
Update to the fixed version for your release line, for example:npm install serve-static@1.7.2
serve-staticnpm
Affected
>=1.7.0 <1.7.2
Fixed in
1.7.2
Update to the fixed version for your release line, for example:npm install serve-static@1.7.2

Details

Versions of serve-static prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.

Proof of Concept

A link to http://example.com//www.google.com/%2e%2e will redirect to //www.google.com/%2e%2e

Some browsers will interpret this as http://www.google.com/%2e%2e, resulting in an external redirect.

Recommendation

Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.

Is GHSA-c3x7-gjmx-r2ff in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected serve-static, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.