@adonisjs/http-server has an Open Redirect vulnerability

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

指向未可信站点的URL重定向(开放重定向)

@adonisjs/http-server 安全漏洞

@adonisjs/http-server是AdonisJS Framework开源的一个基于Node.js的HTTP服务器框架。 @adonisjs/http-server 7.8.1之前版本和8.0.0-next.0至8.1.3版本以及@adonisjs/core 7.4.0之前版本存在安全漏洞，该漏洞源于response.redirect().back()方法读取Referer标头并重定向至该URL而未验证主机，可能导致攻击者将用户重定向至恶意外部站点。

N/A

N/A