Open Redirect in node-forge

Description

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0
• Patched version(s): 1.0.0

References

• GHSA-8fr3-hfg3-gpgp
• huntr.dev
• CVE-2022-0122
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype pollution in 101 - CVE-2021-25943
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• Improper Verification of Cryptographic Signature in node-forge (GHSA-cfm4-qjh2-4765) - CVE-2022-24771
• Prototype Pollution in Ajv - CVE-2020-15366

Tags:

npm

node-forge