Executive brief
url-parse is a popular JavaScript library used to parse URLs in web applications and Node.js services. The library fails to properly sanitize user-supplied URL input, allowing attackers to bypass hostname validation checks through specially crafted URLs containing backslash characters. This could enable security bypasses in applications that rely on url-parse for URL validation or hostname filtering.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the url-parse library's hostname parsing logic. The vulnerability stems from insufficient sanitization of URL input, specifically allowing backslash-based characters to confuse the hostname parsing regex, enabling attackers to craft malicious URLs that bypass hostname validation checks. No authentication or user interaction is required; the attack is triggered by passing a crafted URL string to the parser. An attacker can exploit this to evade security policies that depend on url-parse for hostname validation or domain filtering. The vulnerability affects versions 0.1.0 through 1.4.4; earlier versions (0.0.0–0.0.4) delegated parsing to native browser/Node.js APIs and are unaffected. A fix was committed and released in version 1.4.5, which adds left-trimming to prevent unsanitized input from generating false positives.
Affected products
- unshiftio url-parse 0.1.0 through 1.4.4
Timeline
- 2020-02-04: disclosed: CVE-2020-8124 published on NVD
- 2020: patched: Fix committed to url-parse repository
- 2022-01-06: advisory: GHSA-46c4-8wrp-j99v published