PT-2022-13299 · Uri.Js · Uri.Js

Published 2022-02-16 · Updated 2022-11-29 · CVE-2022-0613

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions urijs versions prior to 1.19.8

Description The issue allows an attacker to bypass authorization through a user-controlled key. Specifically, it is possible to use case-insensitive protocol schemes, such as HTTP, htTP, HTtp, etc., to bypass existing patches.

Recommendations For versions prior to 1.19.8, update to version 1.19.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of case-insensitive protocol schemes in the urijs module until a patch is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-0613

GHSA-GCV8-GH4R-25X6

Affected Products

Uri.Js

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0613.json · Exploit
• 🔥 https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083 · Exploit
• https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0613 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0613 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0613 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0613 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gcv8-gh4r-25x6 · Vendor Advisory
• https://github.com/medialize/uri.js · Note
• https://t.me/cvenotify/27249 · Telegram Post
• https://t.me/cvenotify/26853 · Telegram Post