Open Redirect in go-chi Chi Router via Tab Character Injection

Executive Summary

This vulnerability is an open redirect flaw in the go-chi chi framework versions 5.2.2 through 5.5.0. It exists in the RedirectSlashes middleware where attackers can embed tab characters in request paths. Browsers strip URL-encoded tabs from the 301 Location header, causing the redirect to resolve as a protocol-relative URL like //evil.com, bypassing security mitigations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP requests for paths containing URL-encoded tab characters (%09) or literal tab characters in the Location header. Use tools like curl to send test requests with crafted paths such as /%09/evil.com/ and check if the response redirects to an external domain. Monitor middleware logs for RedirectSlashes handling.

Useful 0 Not Useful 0

Impact Analysis

Attackers can craft malicious links on trusted domains that redirect users to attacker-controlled sites. This enables phishing attacks, credential theft, malware distribution, and OAuth token-redirect abuse. Exploitation requires user interaction but no authentication or special privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables open redirects, which could be exploited for phishing attacks or unauthorized data access. Such attacks may lead to violations of GDPR (data protection) or HIPAA (health data privacy) by exposing user credentials or sensitive information during redirection to malicious sites.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade go-chi/chi to version 5.5.1 or later, which includes the control-character rejection fix. If upgrading is not immediately possible, disable the RedirectSlashes middleware or implement custom input validation to reject paths containing C0 control characters like TAB.

Useful 0 Not Useful 0