Is CVE-2018-3774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3774 being exploited in the wild.

How severe is CVE-2018-3774?

Low severity, with a CVSS score of 3, published 13 August 2018.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=1.0.0,fixed=1.4.3.

Is there a fix for CVE-2018-3774?

Yes. url-parse (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3774 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-3774?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3774: url-parse open redirect in hostname parsing

CVE-2018-3774 · Severity: low · CVSS 3 · Published 2018-08-13

url-parse is a JavaScript library used to parse and validate URLs in web applications and services. Versions before 1.4.3 incorrectly parse certain malformed URLs, returning wrong hostname values that attackers can exploit to redirect users to unintended sites, bypass authentication checks, or trigger server-side requests to internal systems.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2018-3774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3774 being exploited in the wild.
How severe is CVE-2018-3774?: Low severity, with a CVSS score of 3, published 13 August 2018.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=1.0.0,fixed=1.4.3.
Is there a fix for CVE-2018-3774?: Yes. url-parse (npm): upgrade to 1.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3774 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-3774?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.4.3 or later
```
npm install url-parse@1.4.3
```

Technical details

url-parse versions 1.0.0 through 1.4.2 contain a hostname parsing vulnerability that can be exploited via specially crafted URLs. The library's instruction-based parsing logic fails to correctly validate and extract the hostname component, allowing an attacker to inject or obscure the actual target hostname. This is a network-reachable vulnerability with no authentication required—an attacker can craft a malicious URL and serve it to a user or application that uses url-parse. Successful exploitation leads to open redirect, SSRF, or authentication bypass depending on how the parsed URL is used downstream. The vulnerability was fixed in version 1.4.3.

Affected products

unshiftio url-parse 1.0.0 to 1.4.2

Identifiers

CVE-2018-3774
GHSA-pv4c-p2j5-38j4

Timeline

2018-08-13: disclosed
2018: patched: Fix released in version 1.4.3

References

https://github.com/unshiftio/url-parse/commit/209c296d302317268afbe19700a70c63ecbeb2d2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.