PT-2022-13320 · Parse-Url+3 · Url-Parse+3

Lpinca · Published 2022-02-17 · Updated 2025-12-16 · CVE-2022-0639

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions url-parse versions prior to 1.5.7

Description The issue allows for authorization bypass through a user-controlled key. A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, will return the incorrect href. This can lead to incorrect security decisions if the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request.

Recommendations For versions prior to 1.5.7, update to version 1.5.7 or later to resolve the issue. As a temporary workaround, consider validating the 'hostname' and 'origin' attributes of the output from url-parse to ensure they match expected values before using the 'href' attribute to make a request. Restrict the use of the parse() function with untrusted input until the issue is resolved.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-0639

DLA-3336-1

DLA-4413-1

GHSA-8V38-PW62-9CW2

USN-5973-1

Affected Products

Debian

Linuxmint

Ubuntu

Url-Parse

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0639.json · Exploit
• 🔥 https://huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155 · Exploit
• https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788 · Patch
• https://ubuntu.com/security/CVE-2021-27515 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0639 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0639 · Security Note
• https://ubuntu.com/security/CVE-2022-0686 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0639 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0691 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3774 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0512 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0639 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5973-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0639 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5973-1 · Vendor Advisory