KoaJS Koa Open Redirect Vulnerability in HTTP Header Handler

An open redirect vulnerability has been identified in KoaJS Koa versions through 3.0.0. The issue arises in the 'back' method of the HTTP Header Handler component, specifically within the 'lib/response.js' file. This vulnerability allows for redirection to arbitrary URLs by manipulating the user-controlled Referrer header. The flaw can be exploited remotely, potentially facilitating phishing attacks.

Impact

Exploitation of this vulnerability allows for open redirect, where users can be redirected to malicious sites, increasing the risk of phishing attacks.

Reproduction

To reproduce this vulnerability, set up a KoaJS application using a version prior to 3.0.0. Create a route that uses the 'back' method for redirection. When a request is made to this route with a manipulated Referrer header, the application will redirect to the URL specified in the header, demonstrating the open redirect vulnerability.