Описание
React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.13.2.
A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP Location header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts to be injected into statically generated HTML files if the redirect location originates from an untrusted source.
Отчет
This Moderate flaw in react-router affects applications using Framework Mode with pre-rendering enabled, allowing cross-site scripting (XSS). An untrusted HTTP Location header can inject malicious scripts into statically generated HTML. Red Hat products are only vulnerable if deployed with this specific configuration, as Declarative Mode and Data Mode applications are unaffected.
Меры по смягчению последствий
To mitigate this issue, Red Hat customers should ensure that applications utilizing React Router avoid Framework Mode with pre-rendering enabled, particularly when handling redirect locations from untrusted sources. If this mode is essential, strict validation and sanitization of all input used in redirect URLs are required. Applications configured with Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are not susceptible to this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Fix deferred | ||
| Cryostat 4 | grafana-infinity-datasource-npm | Fix deferred | ||
| Cryostat 4 | react-router | Fix deferred | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/agent-client-rhel9 | Fix deferred | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Fix deferred | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Fix deferred | ||
| Migration Toolkit for Virtualization | mtv-candidate/mtv-console-plugin-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
EPSS
5.4 Medium
CVSS3