Executive brief
URIjs is a popular JavaScript library for parsing and manipulating URLs. An attacker can craft malicious URLs using backslash characters to spoof the hostname, causing the library to incorrectly identify which site a URL points to. This could bypass security filters, enable phishing attacks, or allow attackers to circumvent access controls in applications that rely on hostname validation.
Technical details
The vulnerability is a hostname parsing bypass (CWE-601: URL Redirection to Untrusted Site) in URIjs versions prior to 1.19.7. The root cause is improper handling of backslash characters in the scheme delimiter portion of a URL; an attacker can use combinations like `scheme:/\/\/\hostname` to spoof the hostname. Affected versions incorrectly parse such URLs and return no hostname, while patched versions align with the WHATWG URL specification. The vulnerability requires no authentication or user interaction—an attacker simply needs to provide a malicious URL to an application using the vulnerable library. Exploitation can enable allow/block list bypasses, SSRF attacks, open redirects, and other security decision failures. Version 1.19.7 and later include the fix.
Affected products
- medialize URIjs < 1.19.7
Timeline
- 2021-07-19: disclosed
- 2021-07-19: patched: Version 1.19.7 released