CVE-2022-0686: Authorization Bypass Through User-Controlled Key in url-parse
Summary
CVE-2022-0686: Authorization Bypass Through User-Controlled Key in url-parse. Affects url-parse versions < 1.5.8. Fixed in 1.5.8. How to fix ↓
Also tracked for
- node-url-parse · Debian:11
The same CVE-2022-0686 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The url-parse package is an npm package used for parsing URLs in JavaScript applications. It provides functionality to extract various components of a URL such as the protocol, hostname, path, query parameters, etc. This package is widely used in web development projects to handle and manipulate URLs. However, versions prior to 1.5.8 of url-parse are vulnerable to an Authorization Bypass Through User-Controlled Key.
Vulnerability Detail
The vulnerability in url-parse allows an attacker to bypass authorization mechanisms by providing a user-controlled key. This can lead to unauthorized access to sensitive resources or actions within an application. The issue arises due to improper validation and handling of user-supplied input. By manipulating the key parameter, an attacker can bypass authorization checks and gain unauthorized privileges. This vulnerability has a CVSS score of 9.1, indicating its critical severity.
How To Fix
Minimum fixed version
1.5.8
This is the first release that contains the fix.
npm install url-parse@1.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of url-parse to mitigate the risk of unauthorized access.
Conclusion
The url-parse package prior to version 1.5.8 is vulnerable to an Authorization Bypass Through User-Controlled Key. This critical vulnerability allows attackers to bypass authorization mechanisms and gain unauthorized access to sensitive resources or actions. To mitigate the risk, it is crucial to upgrade to version 1.5.8 or later of the url-parse package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for url-parse →
FAQ
This vulnerability allows an attacker to bypass authorization mechanisms and gain unauthorized access to sensitive resources or actions within an application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you if the vulnerability is present.
Yes, the fix for this vulnerability is available in version 1.5.8 of the url-parse package. It is recommended to upgrade to this version or later to mitigate the risk.
There is no known workaround for this vulnerability. Upgrading to the fixed version of url-parse is the recommended solution.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for url-parse.
