Critical Authorization Bypass in node-url-parse: CVE-2022-0691
Summary
CVE-2022-0691: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9. Affects node-url-parse across 2 version ranges.
< 0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63
< 1.5.3-1+deb11u1
Fixed in 1.5.3-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-url-parse is a popular NPM package used for parsing URLs in Node.js applications. It provides a simple API for handling URLs, making it easier for developers to manipulate and validate URL structures. However, this package has been found to have a critical vulnerability that allows unauthorized access due to improper handling of user-controlled keys.
Vulnerability Detail
CVE-2022-0691 is an authorization bypass vulnerability that affects versions of node-url-parse prior to 1.5.9. The vulnerability arises from the package's failure to properly validate user-controlled keys, which could allow an attacker to bypass authorization mechanisms. This could lead to unauthorized access to sensitive data or functionalities within applications that rely on this package. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
1.5.3-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-url-parseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize user-controlled keys before they are processed by the node-url-parse package. This can help mitigate the risk of unauthorized access until the package is updated.
Conclusion
The CVE-2022-0691 vulnerability in the node-url-parse package poses a significant risk due to its potential for unauthorized access. It is crucial for developers to update to the latest version of the package to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for node-url-parse →
FAQ
CVE-2022-0691 is a critical authorization bypass vulnerability in the node-url-parse package that allows unauthorized access due to improper validation of user-controlled keys.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2022-0691 is 9.8, indicating a critical severity level.
If you cannot upgrade immediately, implement input validation to sanitize user-controlled keys as a temporary workaround.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. More information can be found at https://vulert.com.
Related vulnerabilities
Recent vulnerabilities recorded for node-url-parse.
