Executive brief
The parse-path library, a tool used by developers to process and understand web addresses and file paths, contains a security flaw in versions prior to 5.0.0. This vulnerability allows an attacker to bypass security checks by providing specially crafted input that the library misinterprets. This could lead to unauthorized access to data or actions that should otherwise be restricted.
Technical details
A vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key) exists in the ionicabizau/parse-path package before version 5.0.0. The library fails to properly sanitize or validate components of a path or URL, allowing an attacker to manipulate the output of the parsing function. By providing a malicious URL or path string, an attacker can bypass authorization logic that relies on the library's output to make security decisions. This is a network-reachable vulnerability that requires no authentication or user interaction. The issue was addressed in version 5.0.0 by refactoring the parsing logic to be more secure.
Affected products
- ionicabizau parse-path < 5.0.0
Timeline
- 2022-06-28: advisory: NVD published the CVE record.
- 2022-06-29: disclosed: GHSA advisory published.
- 2022-06-27: patched: Fix committed to the repository.