Is CVE-2022-0512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0512 being exploited in the wild.

How severe is CVE-2022-0512?

Low severity, with a CVSS score of 3.1, published 15 February 2022.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.6.

Is there a fix for CVE-2022-0512?

Yes. url-parse (npm): upgrade to 1.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0512 attacked?

It is attacked over the network.

Am I affected by CVE-2022-0512?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0512: url-parse authorization bypass in userinfo parsing

CVE-2022-0512 · Severity: low · CVSS 3.1 · Published 2022-02-15

url-parse is a JavaScript library used to parse and manipulate URLs. A flaw in how the library handles special characters (the '@' symbol) in the username/password portion of URLs allows an attacker to bypass authorization checks by crafting a malicious URL. This could enable attackers to spoof authentication credentials or redirect API calls to unintended targets.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2022-0512 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0512 being exploited in the wild.
How severe is CVE-2022-0512?: Low severity, with a CVSS score of 3.1, published 15 February 2022.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.6.
Is there a fix for CVE-2022-0512?: Yes. url-parse (npm): upgrade to 1.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0512 attacked?: It is attacked over the network.
Am I affected by CVE-2022-0512?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.5.6 or later
```
npm install url-parse@1.5.6
```

Technical details

The vulnerability is an authorization bypass (CWE-639) in the userinfo (username:password) parsing logic of url-parse. The root cause is incorrect handling of the '@' character within credentials—the library used indexOf() instead of lastIndexOf() for '@', causing it to split the URL at the wrong position when '@' appears in the username or password. An attacker can craft a malicious URL with an embedded '@' in the credentials to deceive the parser into misinterpreting the hostname and port, leading to authorization bypass. No user interaction or authentication is required; the flaw is triggered by network-reachable URL parsing. The fix was released in version 1.5.6, which correctly uses lastIndexOf() to find the rightmost '@' that separates credentials from the host.

Affected products

unshiftio url-parse prior to 1.5.6

Identifiers

CVE-2022-0512
GHSA-rqff-837h-mm52

Timeline

2022-02-15: disclosed
2022-01-30: patched: Fix committed to repository
2022-02-14: other: CVE-2022-0512 published by NVD

References

https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.