Описание
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (). This is patched in versions 7.14.1 and 6.30.4.
A flaw was found in React Router. This vulnerability allows a remote attacker to redirect users to an external, potentially malicious, website. This occurs when specially crafted URLs, containing paths starting with //, are passed to the redirect function, causing them to be misinterpreted as protocol-relative URLs. The severity of the impact depends on how the application validates redirects.
Отчет
A Moderate impact open redirect vulnerability exists in React Router, affecting versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3. This flaw allows a remote attacker to redirect users to arbitrary external websites by crafting URLs that begin with //, which are then misinterpreted as protocol-relative. The exploitability and actual impact on Red Hat products depend on the specific application's redirect validation logic. Applications utilizing React Router in Declarative Mode (<BrowserRouter>) are not affected by this issue.
Меры по смягчению последствий
Application developers using React Router in Red Hat products should implement robust URL validation before performing redirects to prevent misinterpretation of protocol-relative URLs. Additionally, applications configured with Declarative Mode () are not impacted by this vulnerability. Users should exercise caution when interacting with untrusted links.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Fix deferred | ||
| Cryostat 4 | grafana-infinity-datasource-npm | Fix deferred | ||
| Cryostat 4 | react-router | Fix deferred | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/agent-client-rhel9 | Fix deferred | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Fix deferred | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Fix deferred | ||
| Migration Toolkit for Virtualization | mtv-candidate/mtv-console-plugin-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
EPSS
5.4 Medium
CVSS3