CVE-2022-0691 Published: Apr 28, 2022

Authorization Bypass vulnerability in url-parse

CWE-639 9.8 Critical Severity authorization bypass javascript node nodejs npm

@haxatron Reported by Checkmarx Zero

Summary

Authorization Bypass through user-controlled key in url-parse. Bypasses https://hackerone.com/reports/496293 via b (backspace) character.

Product

NPM url-parse versions 1.4.5 through 1.5.8.

Impact

This vulnerability is capable of tricking the parser to interpret a URL as a relative path (without any protocol), bypassing all hostname checks.
It can also lead to a false positive in extractProtocol().

Steps to reproduce

url = parse('bhttp://google.com')
console.log(url)

Expected result:

  slashes: false,
  protocol: '',
  hash: '',
  query: '',
  pathname: 'bhttp://google.com',
  auth: '',
  host: '',
  port: '',
  hostname: '',
  password: '',
  username: '',
  origin: 'null',
  href: 'bhttp://google.com'
}

Remediation

Update url-parse to version 1.5.9.

Credit

This issue was reported by @haxatron through huntr.dev.

Resources

Explore more findings