A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL. This affects applications using router.matchers.slug() on a route parameter reachable by an attacker.
Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example: router.get('/:page', handler).as('pages.show') response.redirect().toRoute('pages.show', { page: '/evil.example.com', }) This generates the following redirect: Location: //evil.example.com Browsers interpret this value as an external URL and redirect the user to https://evil.example.com.
The response.redirect().back() method in @adonisjs/http-server is vulnerable to open redirects. The method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the Referer header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that …