Executive brief
url-parse is a widely-used JavaScript library for parsing URLs into components (hostname, port, pathname, etc.). A specially crafted URL containing an '@' symbol can cause the library to incorrectly parse the URL structure, potentially returning a valid href when the input was malformed. If an application uses the parsed hostname or origin to make security decisions but then uses the href to make an actual request, an attacker could bypass those security checks.
Technical details
url-parse incorrectly handles URLs with an '@' character where userinfo is empty and hostname is missing, such as "http://@/127.0.0.1". The vulnerability is a URL parsing bypass due to CWE-639 (authorization bypass through user-controlled key). When such a URL is parsed, the library returns an empty hostname and origin but a non-empty href, potentially transforming an invalid URL into a valid one. If security logic relies on the hostname or origin field to validate a URL, an attacker can craft a specially-formed URL that passes validation but results in a different target when the href is used to make a request. The fix, committed to version 1.5.7, re-adds empty userinfo to the href when appropriate to preserve the original invalid URL structure.
Affected products
- unshiftio url-parse 1.0.0 through 1.5.6
Timeline
- 2022-02-18: disclosed
- 2022-02-22: patched: Fix committed; version 1.5.7 released