Is CVE-2020-8124 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-8124 being exploited in the wild.

How severe is CVE-2020-8124?

Low severity, with a CVSS score of 3.1, published 6 January 2022.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.4.5.

Is there a fix for CVE-2020-8124?

Yes. url-parse (npm): upgrade to 1.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-8124 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-8124?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8124: npm url-parse improper validation in hostname parsing

CVE-2020-8124 · Severity: low · CVSS 3.1 · Published 2022-01-06

url-parse is a popular JavaScript library used to parse URLs in web applications and Node.js services. The library fails to properly sanitize user-supplied URL input, allowing attackers to bypass hostname validation checks through specially crafted URLs containing backslash characters. This could enable security bypasses in applications that rely on url-parse for URL validation or hostname filtering.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2020-8124 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-8124 being exploited in the wild.
How severe is CVE-2020-8124?: Low severity, with a CVSS score of 3.1, published 6 January 2022.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.4.5.
Is there a fix for CVE-2020-8124?: Yes. url-parse (npm): upgrade to 1.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-8124 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-8124?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.4.5 or later
```
npm install url-parse@1.4.5
```

Technical details

The vulnerability is an improper input validation flaw (CWE-20) in the url-parse library's hostname parsing logic. The vulnerability stems from insufficient sanitization of URL input, specifically allowing backslash-based characters to confuse the hostname parsing regex, enabling attackers to craft malicious URLs that bypass hostname validation checks. No authentication or user interaction is required; the attack is triggered by passing a crafted URL string to the parser. An attacker can exploit this to evade security policies that depend on url-parse for hostname validation or domain filtering. The vulnerability affects versions 0.1.0 through 1.4.4; earlier versions (0.0.0–0.0.4) delegated parsing to native browser/Node.js APIs and are unaffected. A fix was committed and released in version 1.4.5, which adds left-trimming to prevent unsanitized input from generating false positives.

Affected products

unshiftio url-parse 0.1.0 through 1.4.4

Identifiers

CVE-2020-8124
GHSA-46c4-8wrp-j99v

Timeline

2020-02-04: disclosed: CVE-2020-8124 published on NVD
2020: patched: Fix committed to url-parse repository
2022-01-06: advisory: GHSA-46c4-8wrp-j99v published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.