Is CVE-2021-3647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-3647 being exploited in the wild.

How severe is CVE-2021-3647?

Low severity, with a CVSS score of 3, published 19 July 2021.

Which products and versions are affected?

urijs (npm) SEMVER:introduced=0,fixed=1.19.7.

Is there a fix for CVE-2021-3647?

Yes. urijs (npm): upgrade to 1.19.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-3647 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-3647?

Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-3647: URIjs hostname spoofing via backslashes in URL

CVE-2021-3647 · Severity: low · CVSS 3 · Published 2021-07-19

URIjs is a popular JavaScript library for parsing and manipulating URLs. An attacker can craft malicious URLs using backslash characters to spoof the hostname, causing the library to incorrectly identify which site a URL points to. This could bypass security filters, enable phishing attacks, or allow attackers to circumvent access controls in applications that rely on hostname validation.

Technologies: urijs (npm). Vendors: npm.

Quick answers

Is CVE-2021-3647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-3647 being exploited in the wild.
How severe is CVE-2021-3647?: Low severity, with a CVSS score of 3, published 19 July 2021.
Which products and versions are affected?: urijs (npm) SEMVER:introduced=0,fixed=1.19.7.
Is there a fix for CVE-2021-3647?: Yes. urijs (npm): upgrade to 1.19.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-3647 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-3647?: Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urijs (npm): upgrade to 1.19.7 or later
```
npm install urijs@1.19.7
```

Technical details

The vulnerability is a hostname parsing bypass (CWE-601: URL Redirection to Untrusted Site) in URIjs versions prior to 1.19.7. The root cause is improper handling of backslash characters in the scheme delimiter portion of a URL; an attacker can use combinations like `scheme:/\/\/\hostname` to spoof the hostname. Affected versions incorrectly parse such URLs and return no hostname, while patched versions align with the WHATWG URL specification. The vulnerability requires no authentication or user interaction—an attacker simply needs to provide a malicious URL to an application using the vulnerable library. Exploitation can enable allow/block list bypasses, SSRF attacks, open redirects, and other security decision failures. Version 1.19.7 and later include the fix.

Affected products

medialize URIjs < 1.19.7

Identifiers

CVE-2021-3647
GHSA-89gv-h8wf-cg8r

Timeline

2021-07-19: disclosed
2021-07-19: patched: Version 1.19.7 released

References

https://github.com/medialize/URI.js/security/advisories/GHSA-89gv-h8wf-cg8r

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.