CVE-2026-22029 React Router开放重定向导致JavaScript执行漏洞

// CVE-2026-22029 PoC - Open Redirect in React Router loaders // Attack scenario: Malicious redirect via loader // Example 1: Malicious loader in Framework Mode // This demonstrates how an attacker can redirect users to malicious sites const express = require('express'); const { createRequestHandler } = require('@remix-run/express'); // Vulnerable loader code (DO NOT USE) const loader = async ({ request }) => { const url = new URL(request.url); const redirectTo = url.searchParams.get('redirect'); // Vulnerable: Direct use of user input in redirect without validation if (redirectTo) { throw new Response(null, { status: 302, headers: { Location: redirectTo } }); } }; // Example 2: Action redirect vulnerability // Demonstrates unsafe redirect from action responses const action = async ({ request }) => { const formData = await request.formData(); const destination = formData.get('destination'); // Vulnerable: No validation of redirect destination return new Response(null, { status: 302, headers: { Location: destination } }); }; // Example 3: JavaScript URI scheme exploitation // Attack URL: /api/redirect?url=javascript:alert(document.cookie) const javascriptRedirectLoader = async ({ request }) => { const url = new URL(request.url); const maliciousUrl = url.searchParams.get('url'); // This allows javascript: protocol execution throw new Response(null, { status: 302, headers: { Location: maliciousUrl } }); }; // Example 4: External domain redirect // Attack URL: /page?next=https://evil.com/phishing const externalRedirectLoader = async ({ request }) => { const url = new URL(request.url); const next = url.searchParams.get('next'); // Vulnerable: No domain whitelist validation return new Response(null, { status: 302, headers: { Location: next } }); }; // Secure implementation (FIXED version) const secureLoader = async ({ request }) => { const url = new URL(request.url); const redirectTo = url.searchParams.get('redirect'); // SECURE: Validate and whitelist allowed domains const allowedDomains = ['https://trusted-domain.com', 'https://app.example.com']; if (redirectTo) { try { const redirectUrl = new URL(redirectTo); if (allowedDomains.some(domain => redirectUrl.origin === domain)) { throw new Response(null, { status: 302, headers: { Location: redirectTo } }); } } catch (e) { // Invalid URL or not in whitelist return new Response('Invalid redirect', { status: 400 }); } } }; // Mitigation: Upgrade to @remix-run/router >= 1.23.2 or react-router >= 7.12.0