--- title: "CX-2022-5018" date: "2022-09-12T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5018/" --- # CX-2022-5018 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) No CVE assigned **Published:** Sep 12, 2022 9.1 Critical Severity authentication bypass javascript node nodejs npm @ @ranjit-git Reported by Checkmarx Zero Details Overview ## Summary Authentication Bypass by Primary Weakness in parse-url. ## Product parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5. ## Steps to reproduce parse-url not able verify urldomain properly when basic authentication is given .This allow to bypass hostname validation . Lets username is admin and password is password123@ and hostname is 127.0.0.1 . so the url will be [http://admin:password123@@127.0.0.1](http://admin:password123@@127.0.0.1) . And there is blacklist check for domain 127.0.0.1 and every request to 127.0.0.1 will be blocked . Now lets use parse-url ```// parseUrl("http://admin:password123@@127.0.0.1/xxxx") ``` ### Expected result: ```{ protocol: 'http', port: null, resource: 'admin', user: '', pathname: '/password123@@127.0.0.1/xxx', hash: '', search: '', href: 'http://admin:password123@@127.0.0.1/xxx', query: {} } ``` So, here see resource var not able to properly detect the urldomain 127.0.0.1 which allow bypass domain verifiaction. Here resource is selected as admin and also pathname is not able to detect properly . If there is pathname validation present like blackilist for path /xxx then it will bypass here as here returned pathname is /password123@@127.0.0.1/xxx . I see all other nodejs url parse like nodejs default url parser able to detect this properly but parse-url is vulnerable here . ## Remediation Update parse-url to 6.0.1 or 7.0.0. ## Credit This issue was reported by @ranjit-git through huntr.dev. ## Resources 1. [21c72ab](https://github.com/ionicabizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3) 2. [Disclosure](https://huntr.dev/bounties/43dcedb6-1f1f-45f9-8611-877c1990a3b5/) 0 Critical Severity CVSS v3.1 Score 9.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None Advisory Timeline1. Disclosed Jan 10, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)