Description
This article is a copy from the r0t1v’s Blog. I’ve decided to include it here because it was found by our team (@fabiopirespt , @fjreis , @r0t) 🙂
At our company we had a pentesting job to a Node.js web application. After some research I found https://nodesecurity.io, a great website with node.js vulnerabilities. Since the web app from our client was using express.js, the next thing was to look for vulnerabilities to express.js.
And this is what I found, https://nodesecurity.io/advisories/serve-static-open-redirect, a vulnerability found by Pierre-Élie Fauché:
“When using serve-static middleware version < 1.7.2 and it’s configured to mount at the root it creates an open redirect on the site.
For example: If a user visits http://example.com//www.google.com/%2e%2e they will be redirected to //www.google.com/%2e%2e, which some browsers interpret as http://www.google.com/%2e%2e.”
P.S: This vulnerability does not work in Google Chrome but works in Firefox and Opera.
I tested in my client’s app and it was vulnerable.
After a couple of days me, @fabiopirespt and @fjreis decided to search for the top websites using express.js and we found 2 websites belonging to Yahoo and a mobile web application belonging to Linkedin.
Time to test them!
Proof of concept
Issuing the request in burp suite we found that it was not working with two slashes (as Pierre describes in his vulnerability), so we tested with 4 slashes and this is what we got:
Request to touch.www.linkedin.com
Response from touch.www.linkedin.com
Video Poc’s
Report timeline
April 28, 2015 — Bug reported to Linkedin
April 28, 2015 — Confirmation from Linkedin’s security team
May 28, 2015 — Pinged Linkedin team
May 28, 2015 — Bug fixed
September 24, 2015 — Public disclosure
Yahoo
Now the story with Yahoo is more fun. We found two websites from Yahoo using express.js:
Request to developer.yahoo.com
Response from developer.yahoo.com
Request from publish.yahoo.com
Response from publish.yahoo.com
Video Poc’s
Since Yahoo was using HackerOne and open redirects were out of scope, we decided contacted Yahoo by email.
Report timeline:
- May 28, 2015 — Bug reported to Yahoo
- May 28, 2015 — Yahoo’s security team tells to report in HackerOne
- May 28, 2015 — Bug reported to HackerOne
- May 28, 2015 — Response from HackerOne: “Thank you for your submission to Yahoo! We are aware of this functionality on our site and it is working as designed. Open redirects have been out of scope since January 1st, 2014. Please continue to send us vulnerability reports!”
- September 24, 2015 — Public disclosure
After a while, they decided to fix these issues :.