Is CVE-2022-0691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0691 being exploited in the wild.

How severe is CVE-2022-0691?

Low severity, with a CVSS score of 3, published 22 February 2022.

Which products and versions are affected?

url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.9.

Is there a fix for CVE-2022-0691?

Yes. url-parse (npm): upgrade to 1.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0691 attacked?

It is attacked over the network.

Am I affected by CVE-2022-0691?

Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0691: url-parse hostname/protocol parsing bypass via control characters

CVE-2022-0691 · Severity: low · CVSS 3 · Published 2022-02-22

url-parse is a JavaScript library used to parse URLs and extract components like hostname and protocol. When URLs contain leading control characters, url-parse fails to strip them and misinterprets the URL structure, while standard web parsers handle them correctly. This can enable attackers to bypass security filters that rely on url-parse for protocol validation, potentially leading to XSS attacks through malicious javascript: protocol URLs.

Technologies: url-parse (npm). Vendors: npm.

Quick answers

Is CVE-2022-0691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0691 being exploited in the wild.
How severe is CVE-2022-0691?: Low severity, with a CVSS score of 3, published 22 February 2022.
Which products and versions are affected?: url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.9.
Is there a fix for CVE-2022-0691?: Yes. url-parse (npm): upgrade to 1.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0691 attacked?: It is attacked over the network.
Am I affected by CVE-2022-0691?: Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

url-parse (npm): upgrade to 1.5.9 or later
```
npm install url-parse@1.5.9
```

Technical details

url-parse fails to strip leading control characters (e.g., \b, null bytes) from URLs before parsing, whereas the WHATWG URL standard parser trims these characters. This causes url-parse to misclassify absolute URLs (containing hostname and protocol) as relative URLs when preceded by control characters. The vulnerability is rooted in the custom MOARE regex parser introduced in version 0.1.0; versions 0.0.0–0.0.4 delegated parsing to platform implementations (Node.js url.parse or DOM) and are unaffected. An attacker can exploit this discrepancy in security-critical contexts: if an application uses url-parse to validate that a URL does not use the javascript: protocol before rendering it in HTML, a URL like "\bjavascript:alert(1)" will bypass the check. The application would then pass the URL to a browser or other WHATWG-compliant parser, which strips the control character and interprets it as a javascript: URL, leading to XSS. The fix was released in version 1.5.9.

Affected products

unshiftio url-parse 0.1.0 to 1.5.8

Identifiers

CVE-2022-0691
GHSA-jf5r-8hm2-f872

Timeline

2022-02-22: disclosed
2022-02-22: patched: version 1.5.9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.