Executive brief
parse-url is a popular JavaScript library used to parse and normalize URLs. This vulnerability allows attackers to bypass URL validation, potentially enabling Server-Side Request Forgery (SSRF) attacks where an application using the library could be tricked into making unauthorized requests to internal systems or external targets, compromising data confidentiality and system availability.
Technical details
This is a Server-Side Request Forgery (CWE-918) vulnerability in the parse-url library prior to version 6.0.1 (fixed in 6.0.1). The root cause involves improper URL validation or parsing logic that fails to properly sanitize or restrict URL input. An attacker can craft malicious URLs that bypass the library's validation, potentially allowing server-side code to make unintended HTTP requests to internal or restricted network resources. No authentication is required; the vulnerability is triggered by providing a specially crafted URL string to the parsing function. The fix was applied in commit 21c72ab with code refactoring and dependency upgrades.
Affected products
- <UNKNOWN> parse-url prior to 6.0.1
Timeline
- 2022-06-28: disclosed
- 2022-06-27: patched: Fix applied via commit 21c72ab