Executive brief
node-forge is a popular JavaScript library providing cryptographic and network utilities. The library's URL parsing function (forge.util.parseUrl) contains a flaw in its regex validation that allows malicious URLs to be improperly parsed, potentially enabling attackers to manipulate URL redirects and bypass security filters. This vulnerability affects applications that pass untrusted user input to this function.
Technical details
The vulnerability is an open redirect flaw (CWE-601) in node-forge's forge.util.parseUrl function, caused by improper regex-based URL validation. When the function processes certain malformed or specially crafted URLs, it fails to parse them correctly, resulting in a data structure that can lead to undesired behavior such as redirecting users to untrusted sites. The attack requires an application to directly or indirectly call forge.util.parseUrl with attacker-controlled input. The vulnerability was fixed by removing the vulnerable URL parsing APIs entirely in version 1.0.0, with the recommendation that applications use the WHATWG URL Standard API instead.
Affected products
- Digital Bazaar node-forge < 1.0.0
Timeline
- 2022-01-06: disclosed
- 2022-01-08: patched: Fixed in version 1.0.0