Is CVE-2022-3224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-3224 being exploited in the wild.

How severe is CVE-2022-3224?

Low severity, with a CVSS score of 3.1, published 16 September 2022.

Which products and versions are affected?

parse-url (npm) SEMVER:introduced=0,fixed=8.1.0.

Is there a fix for CVE-2022-3224?

Yes. parse-url (npm): upgrade to 8.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-3224 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-3224?

Check whether you run parse-url (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-3224: parse-url hostname spoofing via incorrect URL parsing

CVE-2022-3224 · Severity: low · CVSS 3.1 · Published 2022-09-16

parse-url is a popular npm library used to parse and normalize URLs in Node.js applications. The library incorrectly parses certain HTTP and HTTPS URLs, misidentifying the protocol as SSH and potentially spoofing hostnames. An attacker could exploit this by crafting malicious URLs to bypass URL validation, redirect traffic to attacker-controlled servers, or trick applications into connecting to wrong hosts.

Technologies: parse-url (npm). Vendors: npm.

Quick answers

Is CVE-2022-3224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-3224 being exploited in the wild.
How severe is CVE-2022-3224?: Low severity, with a CVSS score of 3.1, published 16 September 2022.
Which products and versions are affected?: parse-url (npm) SEMVER:introduced=0,fixed=8.1.0.
Is there a fix for CVE-2022-3224?: Yes. parse-url (npm): upgrade to 8.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-3224 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-3224?: Check whether you run parse-url (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-url (npm): upgrade to 8.1.0 or later
```
npm install parse-url@8.1.0
```

Technical details

parse-url prior to version 8.1.0 contains a misinterpretation of input vulnerability (CWE-115) in its URL parsing logic. The library fails to correctly parse certain HTTP or HTTPS URLs, sometimes identifying the protocol as SSH instead, and may also parse the hostname incorrectly. The vulnerability is triggered when processing specially crafted URLs and requires no authentication or special privileges. An attacker can exploit this by providing malicious URLs to an application that uses parse-url for validation or redirection, potentially causing hostname spoofing attacks. The fix was released in version 8.1.0.

Affected products

Ionic Bizau parse-url prior to 8.1.0

Identifiers

CVE-2022-3224
GHSA-pqw5-jmp5-px4v

Timeline

2022-09-16: disclosed: Advisory published
2022-09-16: patched: Version 8.1.0 released with fix

References

https://github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.