CVE-2021-23384: 
JavaScript vulnerability analysis and mitigation

CVE-2021-23384 is an Open Redirect vulnerability affecting the koa-remove-trailing-slashes package versions below 2.0.2. The vulnerability was disclosed on March 15, 2021, and published on May 17, 2021. The vulnerability exists in the removeTrailingSlashes() function within index.js, where the web server uses relative URLs instead of absolute URLs, potentially allowing for malicious redirects (Snyk).

The vulnerability allows for open redirect attacks through the use of trailing double slashes in the URL when accessing vulnerable endpoints (e.g., https://example.com//attacker.example/). The CVSS v3.1 base score is 5.4 (Medium), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, and Availability: None (Snyk).

When exploited, this vulnerability can lead to open redirects, potentially allowing attackers to redirect users to malicious websites. The impact includes potential loss of confidentiality and integrity, though both are limited in scope. The vulnerability does not affect system availability (Snyk).

The vulnerability has a proof-of-concept exploit available. It requires user interaction for successful exploitation, but no special privileges are needed. The exploit probability is rated at 0.14% (52nd percentile) according to the EPSS model (Snyk).

The recommended mitigation is to upgrade koa-remove-trailing-slashes to version 2.0.2 or higher, which contains the fix for this vulnerability (Snyk).