GHSA-5wvv-q5fv-2388 hyper-staticfile's location header incorporates user input, allowing open redirect
An attacker can craft URLs that redirect users to malicious domains, facilitating phishing attacks against users of the hyper-staticfile library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-5wvv-q5fv-2388?
GHSA-5wvv-q5fv-2388 is a vulnerability in hyper-staticfile, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When hyper-staticfile performs a redirect for a directory request (e.g. a request for /dir that redirects to /dir/), the Location header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead.
An attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.
Which versions are affected by GHSA-5wvv-q5fv-2388?
5 open source packages ship an affected version, including hyper-staticfile.
| Package | Affected | Fixed in |
|---|---|---|
hyper-staticfile crates.io | All versions | 0.9.4 |
hyper-staticfile crates.io | All versions | 0.9.4 |
hyper-staticfile crates.io | From 0.0.0-0 | 0.9.4, 0.10.0-alpha.5 |
hyper-staticfile crates.io | From 0.10.0-alpha.1 | 0.10.0-alpha.5 |
hyper-staticfile crates.io | From 0.10.0-alpha.1 | 0.10.0-alpha.5 |
How do I fix GHSA-5wvv-q5fv-2388?
Upgrade hyper-staticfile to a fixed version for your release line: 0.9.4 or 0.10.0-alpha.5.
Is GHSA-5wvv-q5fv-2388 being exploited?
There is no known exploitation of GHSA-5wvv-q5fv-2388 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0072.