Is CVE-2021-27515 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-27515 being exploited in the wild.

How severe is CVE-2021-27515?

Low severity, with a CVSS score of 3.1, published 6 May 2021.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.0.

Is there a fix for CVE-2021-27515?

Yes. url-parse (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-27515 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-27515?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-27515: url-parse path traversal via backslash mishandling

CVE-2021-27515 · Severity: low · CVSS 3.1 · Published 2021-05-06

url-parse is a JavaScript library used to parse and extract components from URLs in web applications. Versions before 1.5.0 incorrectly interpret certain malformed URLs containing backslashes (such as "http:/\") as relative paths rather than absolute URLs, potentially allowing an attacker to bypass path validation or access unintended resources through path traversal.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2021-27515 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-27515 being exploited in the wild.
How severe is CVE-2021-27515?: Low severity, with a CVSS score of 3.1, published 6 May 2021.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.0.
Is there a fix for CVE-2021-27515?: Yes. url-parse (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-27515 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-27515?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.5.0 or later
```
npm install url-parse@1.5.0
```

Technical details

The vulnerability is a path traversal flaw (CWE-23) in url-parse versions 0.1.0 through 1.4.7 caused by improper handling of backslash characters in URL parsing. The library uses a custom MOARE regex parser that fails to correctly reject or normalize backslashes in URLs, causing them to be misinterpreted as relative paths rather than invalid URI components. This affects any application using url-parse to validate, normalize, or route URLs; an attacker can craft a malicious URL with backslashes to bypass security checks or access unintended paths. The vulnerability requires only network access and has no authentication or user interaction prerequisites. The fix was released in version 1.5.0.

Affected products

unshiftio url-parse 0.1.0 through 1.4.7

Identifiers

CVE-2021-27515
GHSA-9m6j-fcg5-2442

Timeline

2021-05-06: disclosed
2021-05-06: patched: Version 1.5.0 released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.