Executive brief
urijs is a widely-used JavaScript library for parsing and manipulating URLs in web applications. Versions prior to 1.19.10 contain an open redirect vulnerability that allows attackers to craft malicious URLs that bypass security checks and redirect users to untrusted websites, potentially leading to phishing attacks or credential theft.
Technical details
urijs versions before 1.19.10 are vulnerable to open redirect (CWE-601) due to a bypass of the previous fix for CVE-2022-0613. The vulnerability exists in the URL parsing logic, specifically in how the library handles scheme delimiters with excessive colons. An attacker can craft a malicious URL that passes the library's validation checks but redirects to an attacker-controlled destination. The vulnerability requires user interaction (a user must click the malicious link or be redirected programmatically). The fix is available in version 1.19.10, which properly handles excessive colons in scheme delimiters.
Affected products
- urijs urijs before 1.19.10
Timeline
- 2022-03-07: disclosed
- 2022-03-07: patched: Version 1.19.10 released with fix