Executive brief
url-parse is a popular JavaScript library used to parse and manipulate URLs in web applications. A vulnerability in the library's URL parsing logic allows attackers to craft malicious URLs that are misparsed, potentially enabling open redirects, server-side request forgery (SSRF) attacks, or bypasses of allowlist/blocklist security controls.
Technical details
The vulnerability is a URL parsing flaw (CWE-601: URL Redirection to Untrusted Site) affecting url-parse versions before 1.5.2. The root cause is an incorrect regex pattern used to extract the hostname from URLs, causing custom protocol URLs with no explicit hostname to have part of their pathname misinterpreted as a hostname. An attacker can craft a malicious URL with a custom protocol that, when parsed by the vulnerable library, yields an unexpected hostname that differs from the browser's standard URL parsing. This can be exploited without authentication or user interaction if the application uses the parsed hostname for security decisions like SSRF prevention or redirect validation. The vulnerability was fixed in version 1.5.2.
Affected products
- unshiftio url-parse 0.1.0 through 1.5.1
Timeline
- 2021-08-10: disclosed
- 2021-08-02: patched: Fix committed to repository