Authorization Bypass Vulnerability in node-url-parse: CVE-2022-0686
Summary
CVE-2022-0686: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8. Affects node-url-parse across 2 version ranges.
< 1.5.3-1+deb11u1
< d5c64791ef496ca5459ae7f2176a31ea53b127e5
Fixed in 1.5.3-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-url-parse is a popular NPM package used for parsing URLs in Node.js applications. It provides a simple interface for handling URL components, making it easier for developers to manipulate and validate URLs. However, prior to version 1.5.8, the package was susceptible to an authorization bypass vulnerability that could allow unauthorized access to sensitive resources.
Vulnerability Detail
CVE-2022-0686 is an authorization bypass vulnerability that arises from a user-controlled key in the node-url-parse package. This flaw allows attackers to manipulate URL parsing to bypass authorization checks, potentially leading to unauthorized access to sensitive data or functionality. The vulnerability affects multiple Debian versions and can have severe implications if exploited, as it compromises the integrity of access controls within applications that rely on this package.
How To Fix
Minimum fixed version
1.5.3-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-url-parseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional validation checks in your application to ensure that URL parsing does not lead to unauthorized access. This may involve manually checking user permissions before processing URLs.
Conclusion
CVE-2022-0686 represents a significant security risk for applications using the node-url-parse package. It is crucial for developers to update to the latest versions to mitigate the risk of unauthorized access. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-url-parse →
FAQ
CVE-2022-0686 is a vulnerability in the node-url-parse package that allows for authorization bypass through user-controlled keys.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of node-url-parse prior to 1.5.8 are affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data or functionality within applications that utilize the node-url-parse package.
The CVSS score for CVE-2022-0686 is 9.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-url-parse.
