Description

H3 provides the getRequestURL utility using the new URL(a, b) constructor. When variable a is attacker-controlled the origin of the resulting URL can be modified.

Proof of Concept

// index.js
import { listen } from "listhen";
import {
  createApp,
  createRouter,
  eventHandler,
  toNodeListener,
  getRequestURL,
} from "../src";

const app = createApp()
const router = createRouter().get("/**", eventHandler((event) =>getRequestURL(event)))
app.use(router);
listen(toNodeListener(app));

Make request to http://localhost:3000//attacker.com/test Output is "http://attacker.com/test"

Impact

The origin of the output URL cannot be trusted.

Highly context dependant, if used to make requests server-side then SSRF is possible.

Here's another report where I abuse a similar issue for CSRF.

Could be possible to chain into more severe bugs.

Nuxt3 imports this utility on the master branch, but no current usage.