Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target.

Details on the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see:

response.redirect(url, [alt]) Performs a [302] redirect to url. The string "back" is specially provided for Referrer support, using alt or "/" when Referrer does not exist.

ctx.redirect('back'); ctx.redirect('back', '/index.html'); ctx.redirect('/login'); ctx.redirect('http://google.com');

however, the "back" method is insecure:

- https://github.com/koajs/koa/blob/master/lib/response.js#L322 back (alt) { const url = this.ctx.get('Referrer') || alt || '/' this.redirect(url) }, Referrer Header is User-Controlled.

PoC

there is a demo for POC: const Koa = require('koa') const serve = require('koa-static') const Router = require('@koa/router') const path = require('path')

const app = new Koa() const router = new Router()

// Serve static files from the public directory app.use(serve(path.join(dirname, 'public')))

// Define routes router.get('/test', ctx => { ctx.redirect('back', '/index1.html') })

router.get('/test2', ctx => { ctx.redirect('back') })

router.get('/', ctx => { ctx.body = 'Welcome to the home page! Try accessing /test, /test2' })

app.use(router.routes()) app.use(router.allowedMethods())

const port = 3000 app.listen(port, () => { console.log(Server running at http://localhost:${port}) }) Proof Of Concept GET /test HTTP/1.1 Host: 127.0.0.1:3000 Referer: http://www.baidu.com Connection: close

GET /test2 HTTP/1.1 Host: 127.0.0.1:3000 Referer: http://www.baidu.com Connection: close !image

!image

Impact https://learn.snyk.io/lesson/open-redirect/

Summary Koa uses an evil regex to parse the X-Forwarded-Proto and X-Forwarded-Host HTTP headers. This can be exploited to carry out a Denial-of-Service attack.

PoC

Coming soon.

Impact This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.

Summary In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5.

PoC Coming soon...

Impact 1. Redirect user to another phishing site 2. Make request to another endpoint of the application based on user's cookie 3. Steal user's cookie