Is CVE-2022-1233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-1233 being exploited in the wild.

How severe is CVE-2022-1233?

Low severity, with a CVSS score of 3, published 5 April 2022.

Which products and versions are affected?

urijs (npm) SEMVER:introduced=0,fixed=1.19.11.

Is there a fix for CVE-2022-1233?

Yes. urijs (npm): upgrade to 1.19.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-1233 attacked?

It is attacked over the network.

Am I affected by CVE-2022-1233?

Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-1233: medialize uri.js URL confusion with missing scheme

CVE-2022-1233 · Severity: low · CVSS 3 · Published 2022-04-05

URI.js is a JavaScript library used to parse and manipulate URLs in web applications. When parsing URLs without a scheme (protocol) and with excessive slashes like "///www.example.com", the library incorrectly parses the hostname as null instead of recognizing it as a domain, causing the URL to be treated differently than web browsers would. This can lead to unintended redirects or cross-site request forgery (CSRF) attacks if user input is parsed without proper validation.

Technologies: urijs (npm). Vendors: npm.

Quick answers

Is CVE-2022-1233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-1233 being exploited in the wild.
How severe is CVE-2022-1233?: Low severity, with a CVSS score of 3, published 5 April 2022.
Which products and versions are affected?: urijs (npm) SEMVER:introduced=0,fixed=1.19.11.
Is there a fix for CVE-2022-1233?: Yes. urijs (npm): upgrade to 1.19.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-1233 attacked?: It is attacked over the network.
Am I affected by CVE-2022-1233?: Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urijs (npm): upgrade to 1.19.11 or later
```
npm install urijs@1.19.11
```

Technical details

The vulnerability is a URL parsing inconsistency in URI.js versions prior to 1.19.11. When a URL lacks a scheme and contains excessive leading slashes (e.g., "///www.example.com"), the parser incorrectly sets hostname to null and stores the entire path as "/www.example.com", diverging from browser behavior which treats this as an absolute URL to www.example.com. This discrepancy (CWE-115: Misinterpretation of Input, CWE-601: URL Redirection to Untrusted Site) can be exploited by attackers to craft URLs that bypass validation logic or trigger unintended redirects. The vulnerability requires network-accessible application parsing untrusted URLs and is remotely exploitable without authentication. A patch was released in version 1.19.11 addressing the parsing logic for scheme-relative URLs with excessive slashes.

Affected products

medialize uri.js < 1.19.11

Identifiers

CVE-2022-1233
GHSA-g694-m8vq-gv9h

Timeline

2022-04-05: disclosed
2022-04-05: patched: Fixed in version 1.19.11

References

https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.