-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-router | npm | >= 7.0.0, <= 7.11.0 | 7.12.0 |
| @remix-run/router | npm | <= 1.23.1 | 1.23.2 |
Miggo AIRoot Cause AnalysisThe core of the vulnerability lies in the normalizeRedirectLocation function within both the @remix-run/router and react-router packages. This function was responsible for processing redirect URLs from loaders and actions. Crucially, it lacked validation for the URL's protocol. This oversight allowed for the injection of javascript: URLs, which, when returned in a redirect response, would be executed by the browser, leading to a cross-site scripting (XSS) vulnerability. The patch addresses this by introducing a blocklist of unsafe protocols (including javascript:, data:, file:, etc.) and checking the redirect URL against this list. Any URL using a blocked protocol will now throw an error, preventing the malicious redirect.
In addition to the primary XSS fix, the patches also introduced Cross-Site Request Forgery (CSRF) protection as a defense-in-depth measure. The new throwIfPotentialCSRFAttack function validates the Origin header of incoming POST requests against a configurable list of allowed origins. This check was added to several functions that handle server-side requests and actions, such as handleDocumentRequest, singleFetchAction, and matchRSCServerRequest, hardening them against CSRF attacks where an attacker could trick a user into performing unintended actions.
normalizeRedirectLocationpackages/router/router.ts
normalizeRedirectLocationpackages/react-router/lib/router/router.ts
handleDocumentRequestpackages/react-router/lib/server-runtime/server.ts
singleFetchActionpackages/react-router/lib/server-runtime/single-fetch.ts
matchRSCServerRequestpackages/react-router/lib/rsc/server.rsc.ts
A Semantic Attack on Google Gemini - Read the Latest Research