Critical Vulnerability in lambdaisland-uri-clojure: Incorrect Authority Parsing
Summary
UBUNTU-CVE-2023-28628: lambdaisland/uri is a pure Clojure/ClojureScript URI library. Affects lambdaisland-uri-clojure versions 1.13.95-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lambdaisland-uri-clojure is a pure Clojure/ClojureScript URI library designed for handling and manipulating URIs effectively. It provides various functionalities for URI parsing, construction, and validation. However, versions prior to 1.14.120 contain a significant vulnerability that affects the parsing of authority components in URIs, potentially allowing attackers to exploit this flaw.
Vulnerability Detail
The vulnerability arises from the authority-regex within the lambdaisland-uri library, which fails to correctly handle the backslash ('') character in usernames. This oversight can lead to incorrect authority parsing, where a maliciously crafted URL such as 'https://example.com@google.com' would incorrectly identify 'google.com' as the host instead of 'example.com'. This misrepresentation can be exploited to bypass host restrictions in applications that rely on accurate URI parsing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version of the library.
Conclusion
The lambdaisland-uri-clojure library has a critical vulnerability that affects URI authority parsing, which can be exploited by attackers. Users are strongly advised to upgrade to the latest version to ensure their applications remain secure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application integrity.
See every vulnerability recorded for lambdaisland-uri-clojure →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability may allow attackers to bypass host restrictions, leading to unauthorized access or data breaches.
Yes, upgrading to version 1.14.120 or later of the lambdaisland-uri-clojure package will resolve the vulnerability.
If an immediate upgrade is not possible, review your application to identify any potential misuse of the library and implement additional security measures to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for lambdaisland-uri-clojure.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
