<p>Upgrade <code>url-parse</code> to version 1.5.6 or higher.</p>

Access Restriction Bypass Affecting url-parse package, versions <1.5.6

Snyk CVSS

Attack Complexity High

Confidentiality High

Threat Intelligence

Exploit Maturity Proof of concept

EPSS 0.08% (34^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JS-URLPARSE-2401205
published 15 Feb 2022
disclosed 15 Feb 2022
credit ranjit-git

Report a new vulnerability Found a mistake?

Introduced: 15 Feb 2022

CVE-2022-0512 Open this link in a new tab CWE-639 Open this link in a new tab

How to fix?

Upgrade url-parse to version 1.5.6 or higher.

Overview

url-parse is a Small footprint URL parser that works seamlessly across Node.js and browser environments.

Affected versions of this package are vulnerable to Access Restriction Bypass due to improper parsing process, that may lead to incorrect handling of authentication credentials and hostname, which allows bypass of hostname validation.

PoC:

// PoC.js
 var parse = require('url-parse')
var cc=parse("http://admin:password123@@127.0.0.1")

//Output:
{ slashes: true,
  protocol: 'http:',
  hash: '',
  query: '',
  pathname: '/',
  auth: 'admin:password123',
  host: '@127.0.0.1',
  port: '',
  hostname: '@127.0.0.1',
  password: 'password123',
  username: 'admin',
  origin: 'http://@127.0.0.1',
  href: 'http://admin:password123@@127.0.0.1/' }