Executive brief
url-parse is a JavaScript library used to parse and manipulate URLs. A flaw in how the library handles special characters (the '@' symbol) in the username/password portion of URLs allows an attacker to bypass authorization checks by crafting a malicious URL. This could enable attackers to spoof authentication credentials or redirect API calls to unintended targets.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the userinfo (username:password) parsing logic of url-parse. The root cause is incorrect handling of the '@' character within credentials—the library used indexOf() instead of lastIndexOf() for '@', causing it to split the URL at the wrong position when '@' appears in the username or password. An attacker can craft a malicious URL with an embedded '@' in the credentials to deceive the parser into misinterpreting the hostname and port, leading to authorization bypass. No user interaction or authentication is required; the flaw is triggered by network-reachable URL parsing. The fix was released in version 1.5.6, which correctly uses lastIndexOf() to find the rightmost '@' that separates credentials from the host.
Affected products
- unshiftio url-parse prior to 1.5.6
Timeline
- 2022-02-15: disclosed
- 2022-01-30: patched: Fix committed to repository
- 2022-02-14: other: CVE-2022-0512 published by NVD