CVE-2025-68470

Executive Summary

CVE-2025-68470 is a URL Redirection to Untrusted Site ('Open Redirect') vulnerability in React Router, a popular routing library for React applications. The flaw affects versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5. An attacker can craft a malicious path that, when used with navigate(), <Link>, or redirect(), causes the application to navigate to an external URL. This can be exploited for phishing, credential theft, or malware distribution. The vulnerability has been patched in versions 6.30.2 and 7.9.6.

Supply Chain & Package Security

This vulnerability affects the react-router and react-router-dom npm packages. Organizations using these packages should immediately update to the patched versions. The attack surface is significant due to the widespread use of React Router in web applications. Supply chain risk is elevated if applications accept untrusted input for navigation paths.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for user interaction (clicking a link) and the limited impact on confidentiality and integrity. However, the ease of exploitation and potential for phishing attacks elevate the risk.

Deep Dive & Mechanics

The vulnerability lies in how React Router processes navigation paths. When an application uses navigate(), <Link>, or redirect() with a user-supplied path, the router does not properly validate whether the path is an internal route or an external URL. An attacker can craft a path like //evil.com or https://evil.com that bypasses the router's internal routing logic, causing the browser to navigate to the external site.

The root cause is insufficient sanitization of the to prop in <Link> and the path argument in navigate() and redirect(). The router should reject paths that are absolute URLs or start with // (protocol-relative URLs).

Vulnerable vs. Patched Code

Vulnerable Code (React Router < 6.30.2 / < 7.9.6):

// Example of vulnerable usage
import { useNavigate } from 'react-router-dom';

function MyComponent() {
  const navigate = useNavigate();
  const userInput = "//evil.com"; // Attacker-controlled

  const handleClick = () => {
    navigate(userInput); // Vulnerable: navigates to evil.com
  };

  return <button onClick={handleClick}>Click me</button>;
}

Patched Code (React Router >= 6.30.2 / >= 7.9.6):

// Patched version validates the path
import { useNavigate } from 'react-router-dom';

function MyComponent() {
  const navigate = useNavigate();
  const userInput = "//evil.com"; // Attacker-controlled

  const handleClick = () => {
    // Patched: navigate() now rejects external URLs
    navigate(userInput); // Throws error or ignores external URL
  };

  return <button onClick={handleClick}>Click me</button>;
}

The patch adds validation to ensure the path is a relative URL or an internal route, preventing navigation to external domains.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A React Router application using a vulnerable version (6.0.0-6.30.1 or 7.0.0-7.9.5).
• The application must accept user input for navigation paths (e.g., via URL parameters, form inputs, or API responses).

Exploitation Steps:

1. Identify a vulnerable endpoint that uses navigate(), <Link>, or redirect() with user-controlled input.
2. Craft a malicious path:
   • //evil.com (protocol-relative)
   • https://evil.com (absolute URL)
   • http://evil.com (absolute URL)
3. Deliver the malicious link to the victim (e.g., via phishing email, social media, or a crafted URL).
4. When the victim clicks the link, the React Router application navigates to the attacker-controlled site.

Example Attack URL:

https://victim-app.com/profile?redirect=//evil.com

If the application uses navigate(redirect) or <Link to={redirect}>, the victim will be redirected to evil.com.

Blue Team (Defender)

Detection:

• Monitor for unusual navigation patterns in application logs.
• Look for URLs containing // or absolute URLs in navigation parameters.
• Use web application firewalls (WAF) to block requests with suspicious redirect parameters.

Mitigation:

• Update React Router to version 6.30.2 or 7.9.6 immediately.
• Implement input validation on the client and server side to reject external URLs.
• Use a whitelist of allowed redirect destinations.
• Educate users about phishing risks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to known malicious domains via HTTP redirects.
  • URLs containing // or absolute URLs in navigation parameters.
• Application Logs:
  • Log entries showing navigation to external URLs from navigate(), <Link>, or redirect().
  • Unusual referrer headers indicating external redirects.
• File IOCs:
  • Presence of vulnerable React Router versions in package.json:
    • "react-router": "6.0.0" to "6.30.1"
    • "react-router-dom": "6.0.0" to "6.30.1"
    • "react-router": "7.0.0" to "7.9.5"
    • "react-router-dom": "7.0.0" to "7.9.5"

Detection Engineering

YARA Rule

rule CVE_2025_68470_React_Router_Open_Redirect {
    meta:
        description = "Detects vulnerable React Router versions in package.json"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-68470"
    strings:
        $vuln1 = /"react-router":\s*"[6]\.[0-9]+\.[0-9]+"/ nocase
        $vuln2 = /"react-router-dom":\s*"[6]\.[0-9]+\.[0-9]+"/ nocase
        $vuln3 = /"react-router":\s*"[7]\.[0-9]+\.[0-9]+"/ nocase
        $vuln4 = /"react-router-dom":\s*"[7]\.[0-9]+\.[0-9]+"/ nocase
        $exclude = /"react-router":\s*"[6]\.[3][0-9]+\.[2-9]+"/ nocase
        $exclude2 = /"react-router-dom":\s*"[6]\.[3][0-9]+\.[2-9]+"/ nocase
        $exclude3 = /"react-router":\s*"[7]\.[9]\.[6-9]+"/ nocase
        $exclude4 = /"react-router-dom":\s*"[7]\.[9]\.[6-9]+"/ nocase
    condition:
        any of ($vuln*) and not any of ($exclude*)
}

Sigma Rule

title: CVE-2025-68470 - React Router Open Redirect Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-68470 via suspicious navigation parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: generic
detection:
    selection:
        cs-uri-query|contains:
            - 'redirect=//'
            - 'redirect=http://'
            - 'redirect=https://'
            - 'next=//'
            - 'next=http://'
            - 'next=https://'
            - 'to=//'
            - 'to=http://'
            - 'to=https://'
    condition: selection
falsepositives:
    - Legitimate redirects to external services (e.g., OAuth)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68470 - React Router Open Redirect Attempt"; flow:to_server,established; content:"redirect="; nocase; pcre:"/(redirect|next|to)=(\/\/|https?:\/\/)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update React Router to version 6.30.2 or 7.9.6:

   npm install react-router@6.30.2 react-router-dom@6.30.2
   # or for v7
   npm install react-router@7.9.6 react-router-dom@7.9.6
   

2. Review application code for any usage of navigate(), <Link>, or redirect() with user-supplied input.
3. Implement server-side validation of redirect URLs using a whitelist approach.

Long-term Mitigations:

• Use Content Security Policy (CSP) headers to restrict navigation origins.
• Conduct regular security audits of third-party dependencies.
• Implement input sanitization for all user-controlled data used in navigation.
• Educate developers on the risks of open redirects and secure coding practices.

Workarounds (if patching is not immediately possible):

• Manually validate navigation paths in application code:

  function safeNavigate(path) {
    if (path.startsWith('//') || path.startsWith('http://') || path.startsWith('https://')) {
      // Reject external URLs
      return;
    }
    navigate(path);
  }
  

Valters IT
Securing Digital Frontiers