Is CVE-2022-0639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0639 being exploited in the wild.

How severe is CVE-2022-0639?

Low severity, with a CVSS score of 3, published 18 February 2022.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=1.0.0,fixed=1.5.7.

Is there a fix for CVE-2022-0639?

Yes. url-parse (npm): upgrade to 1.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0639 attacked?

It is attacked over the network.

Am I affected by CVE-2022-0639?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0639: url-parse incorrect URL parsing with @ symbol

CVE-2022-0639 · Severity: low · CVSS 3 · Published 2022-02-18

url-parse is a widely-used JavaScript library for parsing URLs into components (hostname, port, pathname, etc.). A specially crafted URL containing an '@' symbol can cause the library to incorrectly parse the URL structure, potentially returning a valid href when the input was malformed. If an application uses the parsed hostname or origin to make security decisions but then uses the href to make an actual request, an attacker could bypass those security checks.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2022-0639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0639 being exploited in the wild.
How severe is CVE-2022-0639?: Low severity, with a CVSS score of 3, published 18 February 2022.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=1.0.0,fixed=1.5.7.
Is there a fix for CVE-2022-0639?: Yes. url-parse (npm): upgrade to 1.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0639 attacked?: It is attacked over the network.
Am I affected by CVE-2022-0639?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.5.7 or later
```
npm install url-parse@1.5.7
```

Technical details

url-parse incorrectly handles URLs with an '@' character where userinfo is empty and hostname is missing, such as "http://@/127.0.0.1". The vulnerability is a URL parsing bypass due to CWE-639 (authorization bypass through user-controlled key). When such a URL is parsed, the library returns an empty hostname and origin but a non-empty href, potentially transforming an invalid URL into a valid one. If security logic relies on the hostname or origin field to validate a URL, an attacker can craft a specially-formed URL that passes validation but results in a different target when the href is used to make a request. The fix, committed to version 1.5.7, re-adds empty userinfo to the href when appropriate to preserve the original invalid URL structure.

Affected products

unshiftio url-parse 1.0.0 through 1.5.6

Identifiers

CVE-2022-0639
GHSA-8v38-pw62-9cw2

Timeline

2022-02-18: disclosed
2022-02-22: patched: Fix committed; version 1.5.7 released

References

https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.