Feathers: Open Redirect in OAuth callback enables account takeover

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim's access token and can impersonate them. The application constructs the final redirect URL by concatenating the base origin with the user-supplied redirect parameter. This is exploitable when the origins array is configured and origin values do not end with /. An attacker can supply @attacker.com as the redirect value results in https://target.com@attacker.com#access_token=..., where the browser interprets attacker.com as the host, leading to full account takeover. This issue has been fixed in version 5.0.40.

N/A

指向未可信站点的URL重定向(开放重定向)

Feathers 输入验证错误漏洞

Feathers是Feathers开源的一个轻量级的 Web 框架。用于使用 TypeScript 或 JavaScript 创建 API 和实时应用程序。 Feathers 5.0.39及之前版本存在输入验证错误漏洞，该漏洞源于重定向查询参数未经验证附加到基础来源，允许攻击者通过URL权限注入窃取访问令牌，可能导致账户接管。

N/A

N/A