Nitro Protocol-Relative URL Bypass Leading to Open Redirect (GHSA-9pm8-9p8f-hx9e)

Vulnerability Summary: Open Redirect via Relative URL Bypass in Nitro Protocol Overview When wildcard targets (e.g., ) are configured in Nitro's routing rules ( ), a security vulnerability exists that allows an Open Redirect via Protocol-Relative URLs. Attackers can construct specific request paths to exploit the browser's parsing mechanism for protocol-relative URLs, redirecting users to malicious hosts controlled by the attacker. Scope of Impact Affected Component: and rules within Nitro's routing rules ( ). Trigger Conditions: 1. The routing rule is configured with a wildcard target (e.g., ). 2. The request path contains a specific prefix (e.g., ). Vulnerability Mechanism: - When a request is made to , the resulting header is . - The browser interprets as a protocol-relative URL, resolving it to or , thereby redirecting to a domain controlled by the attacker. - The rule exhibits a similar symmetric issue, potentially causing redirection to unintended internal paths. Remediation The vulnerability is addressed through the following two steps: 1. Upgrade Dependency: Upgrade the library to version . This version fixes the handling of leading slashes in the function, ensuring that scenarios like correctly generate instead of . 2. Inline Runtime Handling: Perform inline folding at runtime for edge cases where the routing rule itself is . The specific logic is as follows: - If or is , do not invoke . - Pass the original pathname directly into . - Strip leading before concatenation. POC Code The following test code is included to verify the vulnerability (POC):

Goal Reached Thanks to every supporter — we hit 100%!

Nitro Protocol-Relative URL Bypass Leading to Open Redirect (GHSA-9pm8-9p8f-hx9e)

More from this source