Open redirect vulnerability exposed when localePrefix: 'as-needed'

[hblee12294]

Description

Hi, I have found an open redirect vulnerability when localePrefix is 'as-needed' . This vulnerability allows an attacker to redirect users to a malicious site by manipulating URL parameters.

The vulnerability occurs due to decodeURI doesn't escape decoded backslashs(%5C & %5c) and will decode them into '\' as an unsafe externalPathname. This unsafe externalPathname will be passed to new URL(normalizeTrailingSlash(url), request.url) to be the redirect destination. But URL will internally replace backslashs with slashes and take it as a new authority (host) part, the host will be parsed wrongly due to this bug(or feature?). Here's an example of what I'm talking about:

// Escaped
const  pathnameWithOtherCodes = 'http://localhost:3000/en/%20example.org'
console.log(decodeURI(pathnameWithOtherCodes)) // Output: http://localhost:3000/en/%2Bexample.org

// Non-escaped
const pathnameWithBackslash = 'http://localhost:3000/en/%5Cexample.org'
console.log(decodeURI(pathnameWithBackslash)) // Output: http://localhost:3000/en/\example.org

// Uncommon behaviour of constructing URL
console.log(new URL("/\\example.org", "http://google.com"))
console.log(new URL("//example.org", "http://google.com"))

/*
*  They both output:
*  {
*    href: 'http://example.org/',
*    origin: 'http://example.org',
*    protocol: 'http:',
*    username: '',
*    password: '',
*    host: 'example.org',
*    hostname: 'example.org',
*    port: '',
*    pathname: '/',
*    search: '',
*    searchParams: URLSearchParams {},
*    hash: ''
*  }
*/

Example:

My project reproduces this issue, access it from this url

https://nextempura.vercel.app/en/%5Cexample.org

References

A similar vulnerability occurred in URI.js, which was fixed by replacing all '\' with ''.

• GitHub Security: GHSA-3329-pjwv-fjpg
• Fixing PR: Simplify host parsing fix medialize/URI.js#403

Verifications

• I've verified that the problem I'm experiencing isn't covered in the docs.
• I've searched for similar, existing issues on GitHub and Stack Overflow.
• I've compared my app to a working example to look for differences.

Mandatory reproduction URL

https://github.com/hblee12294/nextempura

Reproduction description

Steps to reproduce:

1. Clone this repo: https://github.com/hblee12294/nextempura
2. Run pnpm install / npm install / yarn install
3. Run pnpm dev / pnpm run dev / yarn dev
4. Open localhost:3000 in the browser
5. Visit http://localhost:3000/en/%5Cexample.org

Expected behaviour

The website will be redirected to example.org, but it should be http://localhost:3000/%5Cexample.org.

[hblee12294]

I'll create a pr to fix this issue shortly.