Critical URL Redirection Vulnerability in node-url-parse Package
Summary
DEBIAN-CVE-2021-3664: url-parse is vulnerable to URL Redirection to Untrusted Site. Affects node-url-parse versions < 1.5.3-1. Fixed in 1.5.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-url-parse package is a widely used library in the Node.js ecosystem that provides functionality for parsing URLs. It is essential for applications that require URL manipulation and validation. However, this package has been identified to have a vulnerability that allows for URL redirection to untrusted sites, potentially exposing users to phishing attacks or other malicious activities.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2021-3664, arises from improper handling of URLs within the node-url-parse package. This flaw can be exploited by an attacker to redirect users to untrusted sites, leading to potential data theft or malware installation. The vulnerability affects multiple versions of the package across various Debian releases, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
1.5.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-url-parseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to implement input validation to restrict the URLs that can be processed by the application. This can help mitigate the risk of redirection to untrusted sites.
Conclusion
The node-url-parse package has a critical vulnerability that allows for URL redirection to untrusted sites. It is essential for users to update to the patched version 1.5.3-1 to mitigate risks. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for node-url-parse →
FAQ
The vulnerability allows for URL redirection to untrusted sites, which can lead to phishing attacks.
All versions prior to 1.5.3-1 are affected across Debian 11, 12, 13, and 14.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation to restrict URLs processed by your application as a temporary workaround.
More details can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-3664.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-url-parse.
