Is CVE-2021-27516 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-27516 being exploited in the wild.

How severe is CVE-2021-27516?

Low severity, with a CVSS score of 3.1, published 1 March 2021.

Which products and versions are affected?

urijs (npm) SEMVER:introduced=0,fixed=1.19.6.

Is there a fix for CVE-2021-27516?

Yes. urijs (npm): upgrade to 1.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-27516 attacked?

It is attacked over the network.

Am I affected by CVE-2021-27516?

Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-27516: URIjs hostname spoofing via backslashes

CVE-2021-27516 · Severity: low · CVSS 3.1 · Published 2021-03-01

URIjs is a JavaScript library used to parse and manipulate URLs in web applications. The library incorrectly handles backslash characters in URLs, allowing attackers to spoof the hostname component. If an application relies on URIjs to validate or enforce security policies based on hostname (such as allow/block lists or access controls), an attacker could bypass these protections, potentially leading to unauthorized access or redirects to malicious sites.

Technologies: urijs (npm). Vendors: npm.

Quick answers

Is CVE-2021-27516 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-27516 being exploited in the wild.
How severe is CVE-2021-27516?: Low severity, with a CVSS score of 3.1, published 1 March 2021.
Which products and versions are affected?: urijs (npm) SEMVER:introduced=0,fixed=1.19.6.
Is there a fix for CVE-2021-27516?: Yes. urijs (npm): upgrade to 1.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-27516 attacked?: It is attacked over the network.
Am I affected by CVE-2021-27516?: Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urijs (npm): upgrade to 1.19.6 or later
```
npm install urijs@1.19.6
```

Technical details

The vulnerability is an improper input validation issue (CWE-20) in URL parsing where backslashes in the scheme delimiter are not properly handled. Affected versions of URIjs parse URLs like "https:/\expected-example.com" as having no hostname, whereas the correct behavior (per WHATWG URL specification) is to extract "expected-example.com". The attack vector is network-based with no authentication or user interaction required—an attacker simply crafts a malicious URL and causes an application using URIjs to parse it. Depending on how the application uses the parsed hostname, impacts include bypass of security allow/block lists, Server-Side Request Forgery (SSRF) attacks, and open redirects. Version 1.19.6 and later patch this issue to align with WHATWG URL specification compliance and browser behavior.

Affected products

medialize URIjs before 1.19.6

Identifiers

CVE-2021-27516
GHSA-p6j9-7xhc-rhwp

Timeline

2021-02-22: disclosed
2021-03-01: advisory
2021: patched: Version 1.19.6 released with fix

References

https://github.com/medialize/URI.js/security/advisories/GHSA-p6j9-7xhc-rhwp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.