Update module github.com/TecharoHQ/anubis to v1.23.0 [SECURITY]

Sebastian Kawelkerequested to merge
renovate/go-github.com-techarohq-anubis-vulnerability into main

This MR contains the following updates:

Package Change Age Confidence
github.com/TecharoHQ/anubis v1.15.2 -> v1.23.0 age confidence

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode

GHSA-cf57-c578-7jvv

More information

Details

Summary

When using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to javascript: URLs, it could still trigger dangerous behavior in some cases.

GET https://example.com/.within.website/?redir=javascript:alert() responds with Location: javascript:alert().

Impact

Anybody with a subrequest authentication seems affected. Using javascript: URLs will probably be blocked by most modern browsers, but using custom protocols for third-party applications might still trigger dangerous operations.

Note

This was originally reported by @​mbiesiad against Weblate.

Severity

  • CVSS Score: 0.0 / 10 (None)
  • Vector String: CVSS:3.1/AV:N/AC:L/MR:N/UI:N/S:U/C:N/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

❗ Important

Release Notes retrieval for this MR were skipped because no github.com credentials were available. If you are self-hosted, please see this instruction.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports