Authorization Bypass Vulnerability in node-url-parse: CVE-2022-0639
Summary
CVE-2022-0639: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7. Affects node-url-parse versions < ef45a1355375a8244063793a19059b4f62fc8788. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-url-parse is a widely used package in the Node.js ecosystem that provides utilities for parsing URLs. It is essential for applications that require URL manipulation and validation. The package is utilized in various projects, making it a critical component for developers. However, prior to version 1.5.7, it was found to have a significant security vulnerability that could allow unauthorized access to resources.
Vulnerability Detail
CVE-2022-0639 is an authorization bypass vulnerability that arises from a user-controlled key in the npm package node-url-parse. This flaw allows attackers to manipulate the URL parsing process, potentially gaining unauthorized access to sensitive data or resources. The vulnerability affects versions prior to 1.5.7, and its exploitation could lead to data leakage or unauthorized actions within applications that rely on this package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize user inputs that interact with the URL parsing functionality. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2022-0639 represents a significant security risk for applications using the node-url-parse package prior to version 1.5.7. It is essential for developers to update their dependencies to mitigate this vulnerability and protect their applications from potential unauthorized access.
See every vulnerability recorded for node-url-parse →
FAQ
CVE-2022-0639 is a vulnerability in the node-url-parse package that allows for authorization bypass due to a user-controlled key.
Versions of node-url-parse prior to 1.5.7 are affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data or resources within applications using the affected package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2022-0639 is 5.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for node-url-parse.
