CVE-2018-3774: Open Redirect in url-parse
Summary
CVE-2018-3774: Open Redirect in url-parse. Affects url-parse versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Also tracked for
- node-url-parse · Debian:11
The same CVE-2018-3774 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The url-parse package is an npm package used for parsing URLs in JavaScript applications. It provides functionality to extract various components of a URL such as the protocol, hostname, path, query parameters, etc. This package is widely used in web development projects to handle URL manipulation and parsing tasks. However, versions of url-parse before 1.4.3 have a vulnerability that can lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.
Vulnerability Detail
The vulnerability in url-parse versions before 1.4.3 lies in the incorrect handling of hostnames. When parsing a URL, these versions return the wrong hostname, which can be exploited by an attacker to perform an Open Redirect attack. By manipulating the hostname, an attacker can trick users into visiting a malicious website disguised as a legitimate one. This can lead to phishing attacks, credential theft, or further exploitation of the user's system. Additionally, this vulnerability can also be leveraged for Server Side Request Forgery (SSRF) or Bypass Authentication Protocol attacks.
How To Fix
Minimum fixed version
1.4.3
This is the first release that contains the fix.
npm install url-parse@1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The url-parse package versions before 1.4.3 have a vulnerability that can lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol attacks. It is crucial to update the package to version 1.4.3 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for url-parse →
FAQ
This vulnerability can be exploited by attackers to perform Open Redirect attacks, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol attacks. It can lead to phishing attacks, credential theft, or further exploitation of the user's system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any known vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update the url-parse package to the latest version to mitigate the risk.
There are no publicly known exploits for this vulnerability at the moment. However, it is important to update the affected package to the latest version to prevent any potential exploitation.
This vulnerability was discovered and reported by the GitHub Security Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for url-parse.
