AIKIDO-2024-10191
next-intl is vulnerable to URL Redirection to Untrusted Site ('Open Redirect')
80
High Risk
This Affects:
next-intlTL;DR
Affected versions of the next-intl library are vulnerable to open redirect. The library accepts user-controlled input that specifies a link to an external site and uses it in a redirect, facilitating phishing attacks. The vulnerability occurs because decodeURI does not escape decoded backslashes (%5C & %5c), leading to unsafe external pathnames in the middleware functionality.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next-intl is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 3.11.0 - 3.17.1.
How to fix this
Upgrade the next-intl library to the patch version.
Background Info
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant