CVE-2023-34247: URL Redirection to Untrusted Site ('Open Redirect')

June 14, 2023

Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the @keystone-6/auth package.

References

github.com/advisories/GHSA-jqxr-vjvv-899m
github.com/keystonejs/keystone/pull/8626
github.com/keystonejs/keystone/security/advisories/GHSA-jqxr-vjvv-899m
nvd.nist.gov/vuln/detail/CVE-2023-34247

Code Behaviors & Features

Detect and mitigate CVE-2023-34247 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →