Описание
Route Validation Bypass in call
Affected versions of call do not validate empty parameters, which may result in a bypass of route validation rules.
Proof of Concept
Routing Scheme:
/api/{param}/{param2}/details
Triggering Request Path:
/api///
Recommendation
Update to version 3.0.2 or later.
Пакеты
Наименование
call
npm
Затронутые версииВерсия исправления
>= 2.0.1, < 3.0.2
3.0.2
Связанные уязвимости
CVSS3: 5.3
nvd
больше 7 лет назад
call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules.