Is CVE-2022-1243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-1243 being exploited in the wild.

How severe is CVE-2022-1243?

Low severity, with a CVSS score of 3, published 6 April 2022.

Which products and versions are affected?

urijs (npm) SEMVER:introduced=0,fixed=1.19.11.

Is there a fix for CVE-2022-1243?

Yes. urijs (npm): upgrade to 1.19.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-1243 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-1243?

Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-1243: medialize urijs incorrect protocol extraction via whitespace characters

CVE-2022-1243 · Severity: low · CVSS 3 · Published 2022-04-06

A vulnerability in the urijs library, a tool used by developers to process and validate web addresses (URLs), could allow attackers to bypass security filters. By inserting hidden characters like tabs or new lines into a link, an attacker can trick an application into treating a dangerous script as a safe web link. This can lead to Cross-Site Scripting (XSS) attacks, where malicious code is executed in a user's browser, potentially leading to account takeover or data theft.

Technologies: urijs (npm). Vendors: npm.

Quick answers

Is CVE-2022-1243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-1243 being exploited in the wild.
How severe is CVE-2022-1243?: Low severity, with a CVSS score of 3, published 6 April 2022.
Which products and versions are affected?: urijs (npm) SEMVER:introduced=0,fixed=1.19.11.
Is there a fix for CVE-2022-1243?: Yes. urijs (npm): upgrade to 1.19.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-1243 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-1243?: Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

urijs (npm): upgrade to 1.19.11 or later
```
npm install urijs@1.19.11
```

Technical details

The urijs library (npm package) prior to version 1.19.11 fails to properly sanitize or account for whitespace characters such as \r, \n, and \t during URL parsing. An attacker can craft a URL (e.g., 'ja\r\nvascript:alert(1)') that the library fails to identify as having a 'javascript:' protocol. If an application relies on urijs to validate and block malicious protocols before rendering links in HTML, this flaw allows for a bypass. This leads to Cross-Site Scripting (XSS) when the malformed URL is subsequently executed by a browser that ignores those characters. The issue is fixed in version 1.19.11.

Affected products

medialize urijs < 1.19.11

Identifiers

CVE-2022-1243
GHSA-3vjf-82ff-p4r3

Timeline

2022-04-05: advisory: NVD published CVE-2022-1243
2022-04-06: disclosed: GHSA-3vjf-82ff-p4r3 published
2022-04-07: patched: Fix committed to medialize/URI.js repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.