Is CVE-2022-0686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0686 being exploited in the wild.

How severe is CVE-2022-0686?

Low severity, with a CVSS score of 3.1, published 21 February 2022.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=0,fixed=1.5.8.

Is there a fix for CVE-2022-0686?

Yes. url-parse (npm): upgrade to 1.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0686 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-0686?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0686: url-parse authorization bypass through user-controlled key

CVE-2022-0686 · Severity: low · CVSS 3.1 · Published 2022-02-21

url-parse is a JavaScript library used to parse and validate URLs in web applications and services. A flaw in versions prior to 1.5.8 allows attackers to bypass authorization checks by manipulating how the library processes certain URL components, potentially enabling unauthorized access to protected resources or data.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2022-0686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0686 being exploited in the wild.
How severe is CVE-2022-0686?: Low severity, with a CVSS score of 3.1, published 21 February 2022.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=0,fixed=1.5.8.
Is there a fix for CVE-2022-0686?: Yes. url-parse (npm): upgrade to 1.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0686 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-0686?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.5.8 or later
```
npm install url-parse@1.5.8
```

Technical details

The vulnerability is an authorization bypass (CWE-639) caused by improper handling of user-controlled input in URL parsing, specifically when the port is specified but empty. The library fails to correctly validate or sanitize this malformed input, allowing attackers to craft specially crafted URLs that bypass authentication or authorization mechanisms that depend on URL parsing. The attack requires only network access with no authentication or user interaction required. An attacker can exploit this to access resources they should not have permission to reach. The vulnerability was patched in version 1.5.8, with the fix committed to handle empty port specifications correctly.

Affected products

unshiftio url-parse prior to 1.5.8

Identifiers

CVE-2022-0686
GHSA-hgjh-723h-mx2j

Timeline

2022-02-21: disclosed
2022-02-21: patched: Fixed in version 1.5.8

References

https://github.com/unshiftio/url-parse/commit/d5c64791ef496ca5459ae7f2176a31ea53b127e5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.