Skip to content
Fencer Intel
medium —

GHSA-5wvv-q5fv-2388 json

hyper-staticfile's location header incorporates user input, allowing open redirect

published 3y ago modified 3y ago also RUSTSEC-2022-0072

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

When `hyper-staticfile` performs a redirect for a directory request (e.g. a request for `/dir` that redirects to `/dir/`), the `Location` header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead.

An attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.

Patch / fix

  • crates.io hyper-staticfile 0.9.4, 0.10.0-alpha.5

Is GHSA-5wvv-q5fv-2388 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io hyper-staticfile
<0.9.4
>=0.10.0-alpha.1, <0.10.0-alpha.5
>=0.0.0-0, <0.9.4
>=0.10.0-0, <0.10.0-alpha.5
0.9.4
0.10.0-alpha.5

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.