Executive brief
parse-url is a popular Node.js library for parsing and normalizing URLs. A server-side request forgery (SSRF) vulnerability allows attackers to manipulate URL parsing logic, potentially enabling unauthorized network requests or access to internal services that the application can reach.
Technical details
This SSRF vulnerability exists in parse-url versions prior to 8.1.0 and affects URL parsing logic (CWE-918). The root cause involves improper validation of URL input, allowing specially crafted URLs to bypass security checks. An attacker can supply malformed URLs to an application using the vulnerable library to trigger unintended network requests or access internal resources. The vulnerability requires the library to be called with attacker-controlled input. A patch was released in version 8.1.0, which adds URL validation and length limits to reject invalid URLs.
Affected products
- ionicabizau parse-url prior to 8.1.0
Timeline
- 2022-09-15: disclosed
- 2022-08-03: patched: Version 8.1.0 released with fix adding URL validation and length limit