@asymmetric-effort/specifyjs: No redirect target validation in secureFetch

Description

Location: core/src/shared/secure-fetch.ts

assertSecureUrl validated only the initial request URL. The fetch() API follows redirects by default (up to 20 hops). A request to a valid https:// URL could redirect to http://internal-service/ or other unvalidated destinations.

Recommendation

Update the @asymmetric-effort/specifyjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.136
• Patched version(s): 0.2.136

References

• GHSA-j5qp-p44g-2m49
• CWE-918
• OWASP 2021-A10

Related Issues

• @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection - Vulnerability
• @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state - Vulnerability
• @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) - Vulnerability
• @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@asymmetric-effort/specifyjs