Vulnerability in node-url-parse package - Authorization Bypass and Redirection to Untrusted Sites
Summary
DLA-3336-1: node-url-parse - security update. Affects node-url-parse versions < 1.2.0-2+deb10u2. Fixed in 1.2.0-2+deb10u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-url-parse package is a Node.js module used to parse URLs. It is responsible for extracting various components of a URL, such as the protocol, hostname, port, path, query parameters, and fragments. This package is widely used in Node.js applications to handle and manipulate URLs. However, multiple vulnerabilities have been discovered in the package that can lead to authorization bypass and redirection to untrusted sites.
Vulnerability Detail
The vulnerabilities in the node-url-parse package are as follows:
-
CVE-2021-3664: The package mishandles certain uses of a single (back)slash in the URL, interpreting it as a relative path instead of a normal slash. This can result in allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.
-
CVE-2021-27515: The package incorrectly handles backslashes in the protocol, considering them as relative paths. An application that validates a URL using node-url-parse might pass a malicious link.
-
CVE-2022-0512: Incorrect handling of username and password can lead to failure to properly identify the hostname, resulting in authorization bypass.
-
CVE-2022-0639: Incorrect conversion of
@characters in the protocol in thehreffield can lead to failure to properly identify the hostname, resulting in authorization bypass. -
CVE-2022-0686: The package fails to find the correct hostname when no port number is provided in the URL, potentially leading to SSRF attacks, open redirects, or other vulnerabilities that depend on the
hostnamefield. -
CVE-2022-0691: The package fails to find the correct hostname when the URL contains a backspace (
\b) character, tricking the parser into interpreting the URL as a relative path and bypassing hostname checks.
How To Fix
Minimum fixed version
1.2.0-2+deb10u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-url-parseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The node-url-parse package is vulnerable to multiple security issues that can result in authorization bypass and redirection to untrusted sites. To mitigate these risks, it is crucial to upgrade to version 1.2.0-2+deb10u2 or later. It is also recommended to use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-url-parse →
FAQ
These vulnerabilities can potentially lead to authorization bypass, SSRF attacks, open redirects, or other undesired behavior. Attackers may exploit these vulnerabilities to bypass security measures, redirect users to malicious sites, or perform unauthorized actions.
Yes, all versions of the node-url-parse package prior to version 1.2.0-2+deb10u2 are affected by these vulnerabilities. It is crucial to update to the fixed version to mitigate the risks.
No, there is no known workaround for these vulnerabilities. It is recommended to update the package to the fixed version as soon as possible.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including the ones in the node-url-parse package.
You can find more information about these vulnerabilities, including their CVE identifiers, on the Debian Security Tracker page for the node-url-parse package: https://security-tracker.debian.org/tracker/node-url-parse
Related vulnerabilities
Recent vulnerabilities recorded for node-url-parse.
