Quick answers
- Is CVE-2021-3664 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-3664 being exploited in the wild.
- How severe is CVE-2021-3664?
- Low severity, with a CVSS score of 3.1, published 10 August 2021.
- Which products and versions are affected?
- url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.2.
- Is there a fix for CVE-2021-3664?
- Yes. url-parse (npm): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-3664 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-3664?
- Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- url-parse (npm): upgrade to 1.5.2 or later
npm install url-parse@1.5.2
Technical details
The vulnerability is a URL parsing flaw (CWE-601: URL Redirection to Untrusted Site) affecting url-parse versions before 1.5.2. The root cause is an incorrect regex pattern used to extract the hostname from URLs, causing custom protocol URLs with no explicit hostname to have part of their pathname misinterpreted as a hostname. An attacker can craft a malicious URL with a custom protocol that, when parsed by the vulnerable library, yields an unexpected hostname that differs from the browser's standard URL parsing. This can be exploited without authentication or user interaction if the application uses the parsed hostname for security decisions like SSRF prevention or redirect validation. The vulnerability was fixed in version 1.5.2.
Affected products
- unshiftio url-parse 0.1.0 through 1.5.1
Identifiers
- CVE-2021-3664
- GHSA-hh27-ffr2-f2jc
Timeline
- 2021-08-10: disclosed
- 2021-08-02: patched: Fix committed to repository