Executive brief
url-parse is a JavaScript library used to parse and validate URLs in web applications and services. A flaw in versions prior to 1.5.8 allows attackers to bypass authorization checks by manipulating how the library processes certain URL components, potentially enabling unauthorized access to protected resources or data.
Technical details
The vulnerability is an authorization bypass (CWE-639) caused by improper handling of user-controlled input in URL parsing, specifically when the port is specified but empty. The library fails to correctly validate or sanitize this malformed input, allowing attackers to craft specially crafted URLs that bypass authentication or authorization mechanisms that depend on URL parsing. The attack requires only network access with no authentication or user interaction required. An attacker can exploit this to access resources they should not have permission to reach. The vulnerability was patched in version 1.5.8, with the fix committed to handle empty port specifications correctly.
Affected products
- unshiftio url-parse prior to 1.5.8
Timeline
- 2022-02-21: disclosed
- 2022-02-21: patched: Fixed in version 1.5.8