Executive brief
node-forge is a widely-used cryptography library for JavaScript that handles URL parsing among other functions. A flaw in its parseUrl function mishandles certain malformed URLs containing backslashes, allowing attackers to bypass validation and redirect users to unintended destinations. This could be leveraged in phishing attacks or to redirect authenticated users to malicious sites.
Technical details
The vulnerability is a CWE-601 open redirect in the node-forge library's parseUrl function, which incorrectly interprets certain backslash-prefixed URLs (e.g., "https:/\/\/\") as relative paths rather than absolute URLs. This occurs because the function does not properly validate or normalize URLs before processing them. The parseUrl function was an undocumented internal API used with trusted input, but its exposure to untrusted user input in some deployments enabled the exploit. The vulnerability affects all versions prior to 1.0.0, where the function was removed in favor of the WHATWG URL Standard API. Exploitation requires user interaction (clicking a link) and does not require authentication. An attacker can craft a malicious URL that appears to reference a trusted domain but redirects to an attacker-controlled site.
Affected products
- Digital Bazaar node-forge before 1.0.0
Timeline
- 2022-01-06: disclosed: NVD published CVE-2022-0122
- 2022-01-21: advisory: GitHub Security Advisory GHSA-8fr3-hfg3-gpgp published
- 2022-01-04: patched: Commit removing forge.util.parseUrl merged; fix released in version 1.0.0