Junglewise Threat Intelligence

CVE-2020-26291: Medialize URI.js hostname spoofing via backslashes in URL

CVE-2020-26291 · Severity: low · CVSS 3.1 · Published 2020-12-30

Technologies: Medialize Urijs. Vendors: npm.

Executive brief

URI.js is a popular JavaScript library used by developers to handle and modify web addresses (URLs). A flaw in how it reads certain characters allows an attacker to trick the library into identifying the wrong website as the 'host.' This can lead to security failures where the software incorrectly allows access to restricted data, redirects users to malicious sites, or bypasses safety filters.

Technical details

A vulnerability exists in URI.js (npm package urijs) prior to version 1.19.4 due to improper input validation in the URL parsing logic. Specifically, the parser fails to correctly handle backslash (\) characters when they precede an '@' symbol in the authority component of a URL. An attacker can craft a URL like 'https://expected.com\@attacker.com' which the library incorrectly parses as having 'attacker.com' as the hostname. This discrepancy from the WHATWG URL specification can be exploited to bypass security checks that rely on hostname validation, potentially leading to SSRF, open redirects, or authorization bypasses. The issue is fully resolved in version 1.19.4.

Affected products

  • medialize urijs < 1.19.4

Timeline

  • 2020-12-23: patched: Version 1.19.4 released with a complete fix.
  • 2020-12-30: disclosed: Public advisory published.

References

Related threats