Executive brief
Google Closure Library is a JavaScript library used by web applications for utility functions. A flaw in its URL parsing module (goog.uri) allows an attacker to send specially crafted URLs that the library misinterprets, potentially causing it to extract incorrect authority information from a URL. This could lead to security bypasses in applications relying on URL validation or parsing.
Technical details
The vulnerability is an improper input validation issue (CWE-20) in the goog.uri URL parsing component of Google Closure Library. Versions up to and including v20200224 incorrectly parse malicious URLs and return the wrong authority component. The attack is network-based with no authentication required and involves sending a malicious URL to be parsed; user interaction (e.g., clicking a link or loading a page that processes the URL) may be required depending on application context. An attacker can exploit this to bypass URL validation or access control checks. The vulnerability was fixed in version v20200315; users should update immediately.
Affected products
- Google Closure Library up to and including v20200224
Timeline
- 2020-03-26: disclosed: CVE-2020-8910 published
- 2020-03-26: patched: Fix committed; version v20200315 released
- 2021-05-07: advisory: GitHub advisory GHSA-vh5w-fg69-rc8m published