Is CVE-2020-26291 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-26291 being exploited in the wild.

How severe is CVE-2020-26291?

Low severity, with a CVSS score of 3.1, published 30 December 2020.

Which products and versions are affected?

urijs (npm) SEMVER:introduced=0,fixed=1.19.4.

Is there a fix for CVE-2020-26291?

Yes. urijs (npm): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-26291 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-26291?

Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-26291: Medialize URI.js hostname spoofing via backslashes in URL

CVE-2020-26291 · Severity: low · CVSS 3.1 · Published 2020-12-30

URI.js is a popular JavaScript library used by developers to handle and modify web addresses (URLs). A flaw in how it reads certain characters allows an attacker to trick the library into identifying the wrong website as the 'host.' This can lead to security failures where the software incorrectly allows access to restricted data, redirects users to malicious sites, or bypasses safety filters.

Technologies: urijs (npm). Vendors: npm.

Quick answers

Is CVE-2020-26291 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-26291 being exploited in the wild.
How severe is CVE-2020-26291?: Low severity, with a CVSS score of 3.1, published 30 December 2020.
Which products and versions are affected?: urijs (npm) SEMVER:introduced=0,fixed=1.19.4.
Is there a fix for CVE-2020-26291?: Yes. urijs (npm): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-26291 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-26291?: Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urijs (npm): upgrade to 1.19.4 or later
```
npm install urijs@1.19.4
```

Technical details

A vulnerability exists in URI.js (npm package urijs) prior to version 1.19.4 due to improper input validation in the URL parsing logic. Specifically, the parser fails to correctly handle backslash (\) characters when they precede an '@' symbol in the authority component of a URL. An attacker can craft a URL like 'https://expected.com\@attacker.com' which the library incorrectly parses as having 'attacker.com' as the hostname. This discrepancy from the WHATWG URL specification can be exploited to bypass security checks that rely on hostname validation, potentially leading to SSRF, open redirects, or authorization bypasses. The issue is fully resolved in version 1.19.4.

Affected products

medialize urijs < 1.19.4

Identifiers

CVE-2020-26291
GHSA-3329-pjwv-fjpg

Timeline

2020-12-23: patched: Version 1.19.4 released with a complete fix.
2020-12-30: disclosed: Public advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.